Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 06:58

General

  • Target

    iLemon/setup_1.3.1.1002_qd[1].exe

  • Size

    2.7MB

  • MD5

    330161bf84a6baa1e95b0ceed67c07fd

  • SHA1

    dd449c45828737780de9e6339be8fafb402fc54c

  • SHA256

    3d91f342d175b0ac87398a8ce3fec670b3ccb62f765fa6bf9990a9f4eb211185

  • SHA512

    f026913a923d186bbb5cdb8fee562ab7fd8b10bdd7a3d7f3aa3ae2adbadce6c4a1d7bbb190369986bb7bef47c212439b9e2137f7a2477cb358fa38e0e1f5092e

  • SSDEEP

    49152:yS3SaTZMsW/L1276gXZ7/96aNky9edJORRmR6upg3/GsTV2799iidcTp+zcvzfnn:X0hfCp6eV9edoRmpVsTabivocwE

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\iLemon\setup_1.3.1.1002_qd[1].exe
    "C:\Users\Admin\AppData\Local\Temp\iLemon\setup_1.3.1.1002_qd[1].exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy2020.tmp\FindProcDLL.dll
    Filesize

    3KB

    MD5

    8614c450637267afacad1645e23ba24a

    SHA1

    e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    SHA256

    0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    SHA512

    af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

  • \Users\Admin\AppData\Local\Temp\nsy2020.tmp\System.dll
    Filesize

    11KB

    MD5

    960a5c48e25cf2bca332e74e11d825c9

    SHA1

    da35c6816ace5daf4c6c1d57b93b09a82ecdc876

    SHA256

    484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

    SHA512

    cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

  • \Users\Admin\AppData\Local\Temp\nsy2020.tmp\nsisdl.dll
    Filesize

    14KB

    MD5

    a5a4cee2eb89d2687c05ef74299f0dba

    SHA1

    b9bff5987be422887f2f402357b47db2288a1a42

    SHA256

    cb82268b778703db75961cddef33a695a674f0dfd28b7e710b198ef2d26d3963

    SHA512

    f485267c6239f84d294ed4b0a82f317081e6e2e0c5613bd012bbd496b9ebccb8aca6944e80f84af51d17ac13f4d83480c34edfe37a3a9508ce0e67fc9f0b96f0

  • memory/3048-20-0x00000000004D1000-0x00000000004D2000-memory.dmp
    Filesize

    4KB

  • memory/3048-19-0x00000000004D0000-0x00000000004D3000-memory.dmp
    Filesize

    12KB

  • memory/3048-22-0x00000000004D1000-0x00000000004D2000-memory.dmp
    Filesize

    4KB