Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
02-12-2022 09:03
General
-
Target
payload.dll
-
Size
652KB
-
MD5
a07d575b289ed3a80357c789fa485f14
-
SHA1
048acf120fa7a468a0275212b0a1f32ab8e441c2
-
SHA256
5c09c4175f49c749bf225f84236538086f5b9f1ad8522531fca34739246e4ad9
-
SHA512
15ef8e78e87dcea54f104f1ee1f005f78343a9b1e0ea941b421e3183da5136c6f158f05961b3016ed8fe485abac9fbfabc6e496a7e791913c672ef03839f842c
-
SSDEEP
12288:sRcFR26XFHnPGvjihyc3EdnDzxT0hyDEUiKVTOg4KOrrRSGCMNNlwd:sRMBnPGvjih50nDFTXOKV6WsRSqwd
Score
10/10
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
FlawedGraceRAT
FlawedGrace is a full-featured RAT written in C++.
-
FlawedGraceRat Loader 4 IoCs
Detects FlawedGraceRat x64 loader in memory.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\payload.dll,#11⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4752-132-0x00007FFE95990000-0x00007FFE95A33000-memory.dmpFilesize
652KB
-
memory/4752-133-0x000001FDB66E0000-0x000001FDB6781000-memory.dmpFilesize
644KB
-
memory/4752-134-0x000001FDB7FD0000-0x000001FDB8071000-memory.dmpFilesize
644KB
-
memory/4752-135-0x000001FDB66E0000-0x000001FDB6781000-memory.dmpFilesize
644KB
-
memory/4752-136-0x000001FDB8080000-0x000001FDB8121000-memory.dmpFilesize
644KB