99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834

Analysis

max time kernel
46s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-es
resource tags

arch:x64arch:x86image:win10v2004-20240419-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-04-2024 14:48

Target

$RD2LRHZ.exe
Size

71.3MB
MD5

1035fb8f30ba91c842559b5468f5d119
SHA1

b260c17c7294252ce1b95906abfa7a5341d7d047
SHA256

99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834
SHA512

7a0763fe682a3728e5cb4a27e373bf29bac172ac6d9332775394d2bd7671680f0f19385bb95b6d84b14a3fd88b84e91c8e11a592649d5fd31eebe33c76708017
SSDEEP

393216:pRQU5PZcx+p4C7tvgDwB1JshHA52LpXopwswkV8:pRn5Pix+yDwqa5WlfswkV8

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

2 raw.githubusercontent.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

$RD2LRHZ.exe

description pid process target process

PID 3916 set thread context of 1884 3916 $RD2LRHZ.exe BitLockerToGo.exe

flow	ioc
2	raw.githubusercontent.com

description	pid	process	target process
PID 3916 set thread context of 1884	3916	$RD2LRHZ.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

$RD2LRHZ.exe

description	pid	process	target process
PID 3916 wrote to memory of 1884	3916	$RD2LRHZ.exe	BitLockerToGo.exe
PID 3916 wrote to memory of 1884	3916	$RD2LRHZ.exe	BitLockerToGo.exe
PID 3916 wrote to memory of 1884	3916	$RD2LRHZ.exe	BitLockerToGo.exe
PID 3916 wrote to memory of 1884	3916	$RD2LRHZ.exe	BitLockerToGo.exe
PID 3916 wrote to memory of 1884	3916	$RD2LRHZ.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\$RD2LRHZ.exe
"C:\Users\Admin\AppData\Local\Temp\$RD2LRHZ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:1884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4176

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/1884-9-0x0000000000E00000-0x0000000000E4D000-memory.dmp

Filesize
308KB

Download
memory/1884-11-0x0000000000E00000-0x0000000000E4D000-memory.dmp

Filesize
308KB

Download
memory/1884-13-0x0000000000E00000-0x0000000000E4D000-memory.dmp

Filesize
308KB

Download
memory/1884-14-0x0000000000E00000-0x0000000000E4D000-memory.dmp

Filesize
308KB

Download
memory/3916-0-0x00007FF6CC180000-0x00007FF6D09CF000-memory.dmp

Filesize
72.3MB

Download
memory/3916-1-0x00007FF6CC180000-0x00007FF6D09CF000-memory.dmp

Filesize
72.3MB

Download
memory/3916-3-0x00007FF6CC180000-0x00007FF6D09CF000-memory.dmp

Filesize
72.3MB

Download
memory/3916-8-0x00007FF6CC180000-0x00007FF6D09CF000-memory.dmp

Filesize
72.3MB

Download
memory/3916-12-0x00007FF6CC180000-0x00007FF6D09CF000-memory.dmp

Filesize
72.3MB

Download