99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834

Analysis

max time kernel
45s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-es
resource tags

arch:x64arch:x86image:win10v2004-20240419-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-04-2024 15:25

Target

$RD2LRHZ.exe
Size

71.3MB
MD5

1035fb8f30ba91c842559b5468f5d119
SHA1

b260c17c7294252ce1b95906abfa7a5341d7d047
SHA256

99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834
SHA512

7a0763fe682a3728e5cb4a27e373bf29bac172ac6d9332775394d2bd7671680f0f19385bb95b6d84b14a3fd88b84e91c8e11a592649d5fd31eebe33c76708017
SSDEEP

393216:pRQU5PZcx+p4C7tvgDwB1JshHA52LpXopwswkV8:pRn5Pix+yDwqa5WlfswkV8

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

3 raw.githubusercontent.com

flow	ioc
3	raw.githubusercontent.com

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

$RD2LRHZ.exe

description	pid	process	target process
PID 916 wrote to memory of 2960	916	$RD2LRHZ.exe	BitLockerToGo.exe
PID 916 wrote to memory of 2960	916	$RD2LRHZ.exe	BitLockerToGo.exe
PID 916 wrote to memory of 2960	916	$RD2LRHZ.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\$RD2LRHZ.exe
"C:\Users\Admin\AppData\Local\Temp\$RD2LRHZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:2960

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/916-0-0x00007FF6C8010000-0x00007FF6CC85F000-memory.dmp

Filesize
72.3MB

Download
memory/916-1-0x00007FF6C8010000-0x00007FF6CC85F000-memory.dmp

Filesize
72.3MB

Download
memory/916-3-0x00007FF6C8010000-0x00007FF6CC85F000-memory.dmp

Filesize
72.3MB

Download
memory/916-9-0x00007FF6C8010000-0x00007FF6CC85F000-memory.dmp

Filesize
72.3MB

Download