flawedgracerat | 24a253d5965048030f9910b7042f1575d35078e7308d2ef479fef93fd274a5e0

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 15:34

Target

eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll
Size

1.0MB
MD5

eb65aa9c0d09922c0c3678508a52fe0b
SHA1

cb29e97c300b8a0a821c5fc0d48160a9038d100a
SHA256

24a253d5965048030f9910b7042f1575d35078e7308d2ef479fef93fd274a5e0
SHA512

4a96cfd5fd0ca4fbbbe615d072f9abf2a32cbabc4884cd067ddfb67784bb5224ccd61ec09ce1d26126111ace8b4b89a990298dbaf5068e385a43a779e323a4bf
SSDEEP

24576:fMynlSXu4UDldxzOdjUbZ2gFR5TkUWj672qNJAo:fMg4UtqUAQzJhNJ

Score

10^/10

FlawedGraceRAT
FlawedGrace is a full-featured RAT written in C++.
rat flawedgracerat

FlawedGraceRat Loader 12 IoCs

Detects FlawedGraceRat x86 loader in memory.

resource	yara_rule
behavioral1/memory/2592-3-0x0000000001EA0000-0x0000000001FA7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-4-0x0000000001EA0000-0x0000000001FA7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-5-0x00000000021C0000-0x00000000022C7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-6-0x0000000001EA0000-0x0000000001FA7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-8-0x0000000001EA0000-0x0000000001FA7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-7-0x00000000021C0000-0x00000000022C7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-9-0x0000000002530000-0x0000000002637000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-10-0x00000000021C0000-0x00000000022C7000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-11-0x0000000002530000-0x0000000002637000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-12-0x0000000002640000-0x0000000002747000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-13-0x0000000002640000-0x0000000002747000-memory.dmp	flawgrace_loader_x86
behavioral1/memory/2592-14-0x0000000002530000-0x0000000002637000-memory.dmp	flawgrace_loader_x86

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28
PID 2040 wrote to memory of 2592	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll,#1
  2⤵
  PID:2592

memory/2592-0-0x00000000747E0000-0x00000000748E9000-memory.dmp

Filesize
1.0MB

Download
memory/2592-1-0x0000000074540000-0x0000000074649000-memory.dmp

Filesize
1.0MB

Download
memory/2592-2-0x00000000747E0000-0x00000000748E9000-memory.dmp

Filesize
1.0MB

Download
memory/2592-3-0x0000000001EA0000-0x0000000001FA7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-4-0x0000000001EA0000-0x0000000001FA7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-5-0x00000000021C0000-0x00000000022C7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-6-0x0000000001EA0000-0x0000000001FA7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-8-0x0000000001EA0000-0x0000000001FA7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-7-0x00000000021C0000-0x00000000022C7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-9-0x0000000002530000-0x0000000002637000-memory.dmp

Filesize
1.0MB

Download
memory/2592-10-0x00000000021C0000-0x00000000022C7000-memory.dmp

Filesize
1.0MB

Download
memory/2592-11-0x0000000002530000-0x0000000002637000-memory.dmp

Filesize
1.0MB

Download
memory/2592-12-0x0000000002640000-0x0000000002747000-memory.dmp

Filesize
1.0MB

Download
memory/2592-13-0x0000000002640000-0x0000000002747000-memory.dmp

Filesize
1.0MB

Download
memory/2592-14-0x0000000002530000-0x0000000002637000-memory.dmp

Filesize
1.0MB

Download