parallax | df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34

Analysis

max time kernel
48s
max time network
183s
platform
windows7_x64
resource
win7v20210408
submitted
18-07-2021 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50E671FFE182A6063FB4DD4EF25CEE71.exe
Size

6.6MB
MD5

50e671ffe182a6063fb4dd4ef25cee71
SHA1

f3ac02099a0619d17c5a51797727517b03b17a55
SHA256

df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34
SHA512

e014291d9e3a6310061e1bcfc317e257aad9ca90363c1f989cf357f49dfbfb98554136e996c3e158ede07b60846b4513ee470f2b58161acfb8a2cf34d0fb1c79

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1336-100-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	1336	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1600	50E671FFE182A6063FB4DD4EF25CEE71.tmp
1532	cmdl32.exe

Loads dropped DLL 9 IoCs

pid	Process
468	50E671FFE182A6063FB4DD4EF25CEE71.exe
1600	50E671FFE182A6063FB4DD4EF25CEE71.tmp
1532	cmdl32.exe
1532	cmdl32.exe
1532	cmdl32.exe
1532	cmdl32.exe
1532	cmdl32.exe
1532	cmdl32.exe
1532	cmdl32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\cmdl32.job	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	cmdl32.exe
1108	dllhost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1108	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 468 wrote to memory of 1600	468	50E671FFE182A6063FB4DD4EF25CEE71.exe	28
PID 1600 wrote to memory of 1532	1600	50E671FFE182A6063FB4DD4EF25CEE71.tmp	30
PID 1600 wrote to memory of 1532	1600	50E671FFE182A6063FB4DD4EF25CEE71.tmp	30
PID 1600 wrote to memory of 1532	1600	50E671FFE182A6063FB4DD4EF25CEE71.tmp	30
PID 1600 wrote to memory of 1532	1600	50E671FFE182A6063FB4DD4EF25CEE71.tmp	30
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1532 wrote to memory of 1108	1532	cmdl32.exe	31
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32
PID 1108 wrote to memory of 1336	1108	dllhost.exe	32

C:\Users\Admin\AppData\Local\Temp\50E671FFE182A6063FB4DD4EF25CEE71.exe
"C:\Users\Admin\AppData\Local\Temp\50E671FFE182A6063FB4DD4EF25CEE71.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\is-M3I9P.tmp\50E671FFE182A6063FB4DD4EF25CEE71.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M3I9P.tmp\50E671FFE182A6063FB4DD4EF25CEE71.tmp" /SL5="$7015E,6017948,999936,C:\Users\Admin\AppData\Local\Temp\50E671FFE182A6063FB4DD4EF25CEE71.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Users\Admin\AppData\Local\cmdl32.exe
    "C:\Users\Admin\AppData\Local\cmdl32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        Blocklisted process makes network request
        Drops file in Windows directory
        
        PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-59-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/468-65-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/1108-88-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/1108-90-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Filesize
1.7MB

Download
memory/1108-89-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/1336-92-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Filesize
1.7MB

Download
memory/1336-93-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/1336-94-0x0000000076CB1000-0x0000000076DB127A-memory.dmp

Filesize
1.0MB

Download
memory/1336-100-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1532-81-0x0000000000280000-0x00000000002DB000-memory.dmp

Filesize
364KB

Download
memory/1600-66-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download