Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-08-2021 11:56
Static task
static1
Behavioral task
behavioral1
Sample
cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe
-
Size
3.6MB
-
MD5
0ed2607808cbbef703ef49308748a888
-
SHA1
e87b715c41f89066990bd04686abc57d65330f4b
-
SHA256
cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f
-
SHA512
7b940eb029f83041466ca890f39c16aef7c0dc3feec8bc006d839d6fc56e82f9925233a61909e14fb75ed398bb6fa13c0e9c7f2a102e3c033d7a679225a6dfb8
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/2020-67-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 15 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 2020 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 26 PID 788 wrote to memory of 1264 788 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 11
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe"C:\Users\Admin\AppData\Local\Temp\cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\notepad.exe"C:\Users\Admin\AppData\Local\Temp\cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe"3⤵PID:2020
-
-