Analysis
-
max time kernel
15s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-03-2021 18:40
Static task
static1
Behavioral task
behavioral1
Sample
9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe
-
Size
6.7MB
-
MD5
e7955b7487f9be142b49b64aa511bc7a
-
SHA1
6c644f1ca1226feaec45935e890504ac154d183c
-
SHA256
9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3
-
SHA512
e8c49950a6101c7d3cc73c6efd7343a84da2c293012eb7c33777244d1ed9c1b344d46ff81c691ad6c5ed2103cd51dbdd16fa73b9dbc93df07b3c0417e206b502
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/2692-6-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Blocklisted process makes network request 1 IoCs
flow pid Process 12 2692 rundll32.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RQ.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RQ.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76 PID 512 wrote to memory of 2692 512 9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe"C:\Users\Admin\AppData\Local\Temp\9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\rundll32.exe"C:\Users\Admin\AppData\Local\Temp\9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3.exe"2⤵
- Blocklisted process makes network request
PID:2692
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:2200