Overview

overview

10

Static

static

19480050000.dll

windows7-x64

10

19480050000.dll

windows10-2004-x64

10

Resubmissions

09-10-2022 07:11

221009-hz8hdagfdk 10

Analysis

  • max time kernel
    43s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2022 07:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19480050000.dll

  • Size

    492KB

  • MD5

    b9994adeb2d2280fa382021f90ed543a

  • SHA1

    e923f3817428c782ae8d322675a1894fa1cc80a2

  • SHA256

    bd701c3324f75d6cb5142be787c644155bd4f574a57c6597094f9d845698c044

  • SHA512

    2caff084d42f8abd48deac4481461e9938e18b1b52954ae43310dcca5e8f54ef54a39edfa576a2aa6c65f174097fb450691db2386c9d45c05f0608837984e84d

  • SSDEEP

    6144:bu9eXk43y9Oj7+icKdK8V553LGPLyu7mtR2rO6Lju92V1absqgiMXTFvXItuVvRx:buo4I+KVH530athewbuik4MVb

Score
10/10
cobaltstrikeflawedgraceratbackdoorloaderrattrojan

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • FlawedGraceRAT

    FlawedGrace is a full-featured RAT written in C++.

    ratflawedgracerat
  • FlawedGraceRat Loader 1 IoCs

    Detects FlawedGraceRat x64 loader in memory.

    loader

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\19480050000.dll
    1⤵
      PID:896

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/896-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

      Filesize

      8KB

      Download

    • memory/896-55-0x000007FEF6DA0000-0x000007FEF6E1B000-memory.dmp

      Filesize

      492KB

      Download

    • memory/896-56-0x0000000001DA0000-0x0000000001E18000-memory.dmp

      Filesize

      480KB

      Download