parallax | 80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01

General

Target

80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
Size

476KB
MD5

a39fda372c7f2c9978a39b03a8c8e5dd
SHA1

2b59bbb4ea1e8fb27ac82d30c2a7bb2433fdd567
SHA256

80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01
SHA512

2d9f096f44e05af168603326afa41bc5461466863ca38e8cb5ea7370edb2e0de49b1284b029c867e6e38ad5f6a150e2af03ff08497f82d43e3d361194a2223e0

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1764-9-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29
PID 1724 wrote to memory of 1764	1724	80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe	29

C:\Users\Admin\AppData\Local\Temp\80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
"C:\Users\Admin\AppData\Local\Temp\80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe
  "C:\Users\Admin\AppData\Local\Temp\80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01.exe"
  2⤵
  PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-7-0x0000000001C10000-0x0000000001D90000-memory.dmp

Filesize
1.5MB

Download
memory/1724-6-0x0000000000490000-0x000000000050B000-memory.dmp

Filesize
492KB

Download
memory/1764-3-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1764-5-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1764-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1764-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing