Analysis
-
max time kernel
127s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-04-2020 21:30
Static task
static1
Behavioral task
behavioral1
Sample
bin.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
bin.exe
-
Size
2.4MB
-
MD5
b0fd2a35faeb49f00e94329d364e9872
-
SHA1
0400cd8365b7a95a9679f63e337085b79784eb88
-
SHA256
32b193b31a207856caddeac610618ff05855cf72fb737dd80f78726884f4a8ec
-
SHA512
98ee4d23d233eec5ce3e282f7f6fa92060453e8c0c8ac9aed6f2bb17916aacfac6cb1d89323d2567a74d0efa621c18316a769e9c07bccc242290b81d0d18adfe
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2180 1476 bin.exe 70 PID 1476 wrote to memory of 2180 1476 bin.exe 70 PID 1476 wrote to memory of 2180 1476 bin.exe 70 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 PID 1476 wrote to memory of 2192 1476 bin.exe 71 -
Blacklisted process makes network request 1 IoCs
flow pid Process 5 2192 cmd.exe -
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/2192-1-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\document.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\document.exe DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1476 bin.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe 1476 bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1476 -
C:\Windows\SysWOW64\cmd.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"2⤵PID:2180
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"2⤵
- Blacklisted process makes network request
PID:2192
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:1612