Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 15:34
Static task
static1
Behavioral task
behavioral1
Sample
eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll
Resource
win10v2004-20231215-en
General
-
Target
eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
eb65aa9c0d09922c0c3678508a52fe0b
-
SHA1
cb29e97c300b8a0a821c5fc0d48160a9038d100a
-
SHA256
24a253d5965048030f9910b7042f1575d35078e7308d2ef479fef93fd274a5e0
-
SHA512
4a96cfd5fd0ca4fbbbe615d072f9abf2a32cbabc4884cd067ddfb67784bb5224ccd61ec09ce1d26126111ace8b4b89a990298dbaf5068e385a43a779e323a4bf
-
SSDEEP
24576:fMynlSXu4UDldxzOdjUbZ2gFR5TkUWj672qNJAo:fMg4UtqUAQzJhNJ
Malware Config
Signatures
-
FlawedGraceRAT
FlawedGrace is a full-featured RAT written in C++.
-
Processes:
resource yara_rule behavioral1/memory/2592-3-0x0000000001EA0000-0x0000000001FA7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-4-0x0000000001EA0000-0x0000000001FA7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-5-0x00000000021C0000-0x00000000022C7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-6-0x0000000001EA0000-0x0000000001FA7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-8-0x0000000001EA0000-0x0000000001FA7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-7-0x00000000021C0000-0x00000000022C7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-9-0x0000000002530000-0x0000000002637000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-10-0x00000000021C0000-0x00000000022C7000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-11-0x0000000002530000-0x0000000002637000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-12-0x0000000002640000-0x0000000002747000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-13-0x0000000002640000-0x0000000002747000-memory.dmp flawgrace_loader_x86 behavioral1/memory/2592-14-0x0000000002530000-0x0000000002637000-memory.dmp flawgrace_loader_x86 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 2592 2040 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2592-0-0x00000000747E0000-0x00000000748E9000-memory.dmpFilesize
1.0MB
-
memory/2592-1-0x0000000074540000-0x0000000074649000-memory.dmpFilesize
1.0MB
-
memory/2592-2-0x00000000747E0000-0x00000000748E9000-memory.dmpFilesize
1.0MB
-
memory/2592-3-0x0000000001EA0000-0x0000000001FA7000-memory.dmpFilesize
1.0MB
-
memory/2592-4-0x0000000001EA0000-0x0000000001FA7000-memory.dmpFilesize
1.0MB
-
memory/2592-5-0x00000000021C0000-0x00000000022C7000-memory.dmpFilesize
1.0MB
-
memory/2592-6-0x0000000001EA0000-0x0000000001FA7000-memory.dmpFilesize
1.0MB
-
memory/2592-8-0x0000000001EA0000-0x0000000001FA7000-memory.dmpFilesize
1.0MB
-
memory/2592-7-0x00000000021C0000-0x00000000022C7000-memory.dmpFilesize
1.0MB
-
memory/2592-9-0x0000000002530000-0x0000000002637000-memory.dmpFilesize
1.0MB
-
memory/2592-10-0x00000000021C0000-0x00000000022C7000-memory.dmpFilesize
1.0MB
-
memory/2592-11-0x0000000002530000-0x0000000002637000-memory.dmpFilesize
1.0MB
-
memory/2592-12-0x0000000002640000-0x0000000002747000-memory.dmpFilesize
1.0MB
-
memory/2592-13-0x0000000002640000-0x0000000002747000-memory.dmpFilesize
1.0MB
-
memory/2592-14-0x0000000002530000-0x0000000002637000-memory.dmpFilesize
1.0MB