Analysis
- max time kernel
151s - max time network
153s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/08/2021, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe
- Size 3.6MB
- Sample210804-w2ram32nrs
- SHA256 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f
- MD5 0ed2607808cbbef703ef49308748a888
- SHA1 e87b715c41f89066990bd04686abc57d65330f4b
- SHA512 7b940eb029f83041466ca890f39c16aef7c0dc3feec8bc006d839d6fc56e82f9925233a61909e14fb75ed398bb6fa13c0e9c7f2a102e3c033d7a679225a6dfb8
- MD5 SHA1 SHA512
Malware Config
Signatures
- ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/4012-121-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3044 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3044 Explorer.EXE - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 4012 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 76 PID 2896 wrote to memory of 3044 2896 cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe 27
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe"C:\Users\Admin\AppData\Local\Temp\cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\notepad.exe"C:\Users\Admin\AppData\Local\Temp\cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f.exe"3⤵PID:4012
-
-