parallax | dbe772e7c809915fed298d93fdb53a6239028790a3b8e02dc07b669536ef3471

General

Target

feedback.exe
Size

13.4MB
MD5

6d2f9dca8d6f824c954a1b850a8ccbc5
SHA1

0bfa4822f81fe83f28274394777aeeb555e32424
SHA256

dbe772e7c809915fed298d93fdb53a6239028790a3b8e02dc07b669536ef3471
SHA512

642536a1bdf26692f4bf9d5c581b69e1616a0c17c32144a4ea250e02c9bbbc48680a00ef62aac8e261e485be32aec7c73162dbd623e789c8caf63f8e84b9d4c3

Score

10^/10

parallax ransomware rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1424-10-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1424	rundll32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RomCenter.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	feedback.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	feedback.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	feedback.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	feedback.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	feedback.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	feedback.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe
1812	feedback.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30
PID 1812 wrote to memory of 1424	1812	feedback.exe	30

C:\Users\Admin\AppData\Local\Temp\feedback.exe
"C:\Users\Admin\AppData\Local\Temp\feedback.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Users\Admin\AppData\Local\Temp\feedback.exe"
  2⤵
  - Blocklisted process makes network request
  PID:1424

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-9-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1424-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1812-2-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1812-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1812-4-0x0000000002D90000-0x0000000002E0B000-memory.dmp

Filesize
492KB

Download
memory/1812-8-0x00000000041E0000-0x0000000004360000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads