flawedgracerat | 24a253d5965048030f9910b7042f1575d35078e7308d2ef479fef93fd274a5e0

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 15:34

Target

eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll
Size

1.0MB
MD5

eb65aa9c0d09922c0c3678508a52fe0b
SHA1

cb29e97c300b8a0a821c5fc0d48160a9038d100a
SHA256

24a253d5965048030f9910b7042f1575d35078e7308d2ef479fef93fd274a5e0
SHA512

4a96cfd5fd0ca4fbbbe615d072f9abf2a32cbabc4884cd067ddfb67784bb5224ccd61ec09ce1d26126111ace8b4b89a990298dbaf5068e385a43a779e323a4bf
SSDEEP

24576:fMynlSXu4UDldxzOdjUbZ2gFR5TkUWj672qNJAo:fMg4UtqUAQzJhNJ

Score

10^/10

FlawedGraceRAT
FlawedGrace is a full-featured RAT written in C++.
rat flawedgracerat

FlawedGraceRat Loader 3 IoCs

Detects FlawedGraceRat x86 loader in memory.

Processes:

resource	yara_rule
behavioral2/memory/1616-1-0x00000000024F0000-0x00000000025F7000-memory.dmp	flawgrace_loader_x86
behavioral2/memory/1616-2-0x00000000024F0000-0x00000000025F7000-memory.dmp	flawgrace_loader_x86
behavioral2/memory/1616-3-0x00000000024F0000-0x00000000025F7000-memory.dmp	flawgrace_loader_x86

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2884 wrote to memory of 1616	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1616	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 1616	2884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb65aa9c0d09922c0c3678508a52fe0b_JaffaCakes118.dll,#1
  2⤵
  PID:1616

memory/1616-0-0x0000000074C90000-0x0000000074D99000-memory.dmp

Filesize
1.0MB

Download
memory/1616-1-0x00000000024F0000-0x00000000025F7000-memory.dmp

Filesize
1.0MB

Download
memory/1616-2-0x00000000024F0000-0x00000000025F7000-memory.dmp

Filesize
1.0MB

Download
memory/1616-3-0x00000000024F0000-0x00000000025F7000-memory.dmp

Filesize
1.0MB

Download