Overview

overview

10

Static

static

7f.dll

windows7-x64

10

7f.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    210s
  • max time network
    233s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 15:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f.dll

  • Size

    652KB

  • MD5

    9eb820618526235e327296884cca0254

  • SHA1

    448afe97bf1a7066a54f8f20c123e05de5ab588f

  • SHA256

    2e2a1c24d5bbb4266375a1ed1e5ff7857a4b155d73f82172938a9051f50dc2a2

  • SHA512

    807bf14b47a1b2a684d839e365d03ca159a36d1d503ae677332c83bf1d9f913cbb93ea6140d57d8a56cbe019cd0b49d33153b5e9725232ea0af9cd8b2a9d39e1

  • SSDEEP

    12288:7QSORxmqlIFkn1MID/6XaNhWMlLiMVm4zZEc1zCx+NcxwkWFa/eG:7w3GkzWmJ5iMkCCcVCxRGG

Score
10/10
cobaltstrikeflawedgraceratbackdoorloaderrattrojan

Malware Config

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • FlawedGraceRAT

    FlawedGrace is a full-featured RAT written in C++.

    ratflawedgracerat
  • FlawedGraceRat Loader 1 IoCs

    Detects FlawedGraceRat x64 loader in memory.

    loader

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f.dll,#1
    1⤵
      PID:5088

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5088-132-0x00007FFC44670000-0x00007FFC44713000-memory.dmp
      Filesize

      652KB

      Download
    • memory/5088-133-0x00000253E36B0000-0x00000253E3751000-memory.dmp
      Filesize

      644KB

      Download