flawedgracerat | dump_PE[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
dump_PE.bin
Size 468KB
Sample221009-khk2vsgfe6
SHA256 2cebdfad9beac05766dde5d28faf8895f33de9cc1b3e27d7662c69ca1b60cc37
MD5 2379b733f81a492cfd485810e499299d
SHA1 ee497b907f9ee02174ae9c31bf5a96405f681377
SHA512 be808957703afb5bdf7c07200a3110d89a4df7c77e40089bd3180b5a6be34867d1b2a089fee674a6e60369d88fa4e648b9e6fc86c9530641c52a2a54ec4c6b30
SSDEEP 12288:eTEX2eoX0qivXipJXcS4E9WQuxoaq2AW:eTEPoEqi/Q4E9WQGoa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader flawedgracerat cobaltstrike

Malware Config

Signatures

Cobaltstrike family
cobaltstrike

FlawedGraceRat Loader 1 IoCs

Detects FlawedGraceRat x64 loader in memory.

loader

resource	yara_rule
sample	flawgrace_loader_x64

Flawedgracerat family
flawedgracerat

File Explorer

dump_PE.bin

.dll 468KB

dump_PE.bin

IMPHASH 7edbb1f08aaa2756392c6eb6a6201489
SHA256 2cebdfad9beac05766dde5d28faf8895f33de9cc1b3e27d7662c69ca1b60cc37
MD5 2379b733f81a492cfd485810e499299d
SHA1 ee497b907f9ee02174ae9c31bf5a96405f681377
SHA512 be808957703afb5bdf7c07200a3110d89a4df7c77e40089bd3180b5a6be34867d1b2a089fee674a6e60369d88fa4e648b9e6fc86c9530641c52a2a54ec4c6b30
SSDEEP 12288:eTEX2eoX0qivXipJXcS4E9WQuxoaq2AW:eTEPoEqi/Q4E9WQGoa
MD5 SHA1 SHA512 SSDEEP

windows x64

FlawedGraceRat Loader

Detects FlawedGraceRat x64 loader in memory.

loader

Minor OS version

Major OS version

Entry point

255536

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoInitializeSecurity

kernel32

SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA HeapAlloc HeapFree GetProcessHeap VirtualAlloc VirtualFree Sleep GetLocalTime SystemTimeToFileTime FileTimeToSystemTime GetProcAddress LoadLibraryW GetModuleHandleW HeapSize WriteFile FlushFileBuffers CloseHandle CreateFileW MultiByteToWideChar WideCharToMultiByte FindFirstFileExA FindClose LCMapStringW HeapReAlloc GetFileType GetStdHandle GetStringTypeW GetACP GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GetModuleFileNameA GetModuleHandleExW ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetLastError LocalFree RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount

user32

ShowWindow PostMessageA SendMessageA wsprintfW GetWindowTextA EnumWindows

advapi32

GetUserNameW

oleaut32

VariantClear