parallax | 29369c122e942e2ca2747a55895c0d0439acfc372f5b698b250bb6af7fc90914

General

Target

DHL_988121.exe
Size

712KB
MD5

da9cf01565ca4a3abbe4630656fadd23
SHA1

781194da5ae0e04e02ba0c270483fac9d1c6b431
SHA256

29369c122e942e2ca2747a55895c0d0439acfc372f5b698b250bb6af7fc90914
SHA512

eeeec69db00809b9fa372a3fb9a185e6cefc0a945cb0b0c1f1f99fc36c971f8b28ea28bf617cea5637b60a4def94610e8a5aa6ad0ae41e2c7c6cfbdea3b5b818

Score

10^/10

parallax persistence rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1212-74-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cgobib = "C:\\Users\\Public\\bibogC.url"	DHL_988121.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	1212	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1756 wrote to memory of 1212	1756	DHL_988121.exe	31
PID 1212 wrote to memory of 816	1212	mshta.exe	32
PID 1212 wrote to memory of 816	1212	mshta.exe	32
PID 1212 wrote to memory of 816	1212	mshta.exe	32
PID 1212 wrote to memory of 816	1212	mshta.exe	32

C:\Users\Admin\AppData\Local\Temp\DHL_988121.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_988121.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\mshta.exe
  C:\Windows\System32\mshta.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 140
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-75-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1212-70-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1212-69-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1212-72-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1212-73-0x0000000010540000-0x0000000010566000-memory.dmp

Filesize
152KB

Download
memory/1212-74-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1756-60-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1756-62-0x00000000004D0000-0x00000000004EA000-memory.dmp

Filesize
104KB

Download
memory/1756-65-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing