Analysis

  • max time kernel
    142s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 06:58

General

  • Target

    iLemon/setup_1.3.1.1002_qd[1].exe

  • Size

    2.7MB

  • MD5

    330161bf84a6baa1e95b0ceed67c07fd

  • SHA1

    dd449c45828737780de9e6339be8fafb402fc54c

  • SHA256

    3d91f342d175b0ac87398a8ce3fec670b3ccb62f765fa6bf9990a9f4eb211185

  • SHA512

    f026913a923d186bbb5cdb8fee562ab7fd8b10bdd7a3d7f3aa3ae2adbadce6c4a1d7bbb190369986bb7bef47c212439b9e2137f7a2477cb358fa38e0e1f5092e

  • SSDEEP

    49152:yS3SaTZMsW/L1276gXZ7/96aNky9edJORRmR6upg3/GsTV2799iidcTp+zcvzfnn:X0hfCp6eV9edoRmpVsTabivocwE

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\iLemon\setup_1.3.1.1002_qd[1].exe
    "C:\Users\Admin\AppData\Local\Temp\iLemon\setup_1.3.1.1002_qd[1].exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:2112
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4980

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nst2817.tmp\FindProcDLL.dll
      Filesize

      3KB

      MD5

      8614c450637267afacad1645e23ba24a

      SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

      SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

      SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    • C:\Users\Admin\AppData\Local\Temp\nst2817.tmp\System.dll
      Filesize

      11KB

      MD5

      960a5c48e25cf2bca332e74e11d825c9

      SHA1

      da35c6816ace5daf4c6c1d57b93b09a82ecdc876

      SHA256

      484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

      SHA512

      cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

    • C:\Users\Admin\AppData\Local\Temp\nst2817.tmp\nsisdl.dll
      Filesize

      14KB

      MD5

      a5a4cee2eb89d2687c05ef74299f0dba

      SHA1

      b9bff5987be422887f2f402357b47db2288a1a42

      SHA256

      cb82268b778703db75961cddef33a695a674f0dfd28b7e710b198ef2d26d3963

      SHA512

      f485267c6239f84d294ed4b0a82f317081e6e2e0c5613bd012bbd496b9ebccb8aca6944e80f84af51d17ac13f4d83480c34edfe37a3a9508ce0e67fc9f0b96f0

    • memory/2112-24-0x0000000004821000-0x0000000004822000-memory.dmp
      Filesize

      4KB

    • memory/2112-23-0x0000000004820000-0x0000000004823000-memory.dmp
      Filesize

      12KB

    • memory/2112-26-0x0000000004821000-0x0000000004822000-memory.dmp
      Filesize

      4KB