parallax | e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7

Analysis

max time kernel
60s
max time network
120s
platform
windows10_x64
resource
win10v20201028
submitted
18/02/2021, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe
Size 2.3MB
Sample210218-xcd7rk5pls
SHA256 e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7
MD5 823be1cd7defa02113ad36530c55b278
SHA1 e55ef9e7834fc9371e02fa4bdeb699d1f8819ead
SHA512 997b18aaa326ebaa0de683bd590f704abdbb8d1d8f24cef263723f3211b6f464b60b2266cb3767fa6852870fc4e54611eb1a646c28b24466d3e6ef7ab6be80c5
MD5 SHA1 SHA512

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/4168-4-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe
4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe
4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe
4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78
PID 4704 wrote to memory of 4168	4704	e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe	78

C:\Users\Admin\AppData\Local\Temp\e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe
"C:\Users\Admin\AppData\Local\Temp\e6e9b8fe2bb57d5dc22953b423d6340ef3adf9ebef4852a842c9c87e9d3fead7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4168-4-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4168-3-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download