parallax | bda3868320633ed3af8b26997af76d2a5853b3c8d4e2951efec4510809b1011b

General

Target

SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
Size

3.4MB
MD5

cdf6a63fd74ea83f310a796a9c21c659
SHA1

6637b6960b46f412a15e3a6eadaeda147a27a49b
SHA256

bda3868320633ed3af8b26997af76d2a5853b3c8d4e2951efec4510809b1011b
SHA512

90b8c0b0ea11daa42bd28e4b086161ca79dcb100cd727ecc041671d568178d4ae01e20c24187ce7366ec7855058ca28c1a1582ffded78a214420862f9b1f0c27

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1972-66-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	1972	rundll32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1256	Explorer.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1972	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	26
PID 1200 wrote to memory of 1256	1200	SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe	12

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1256
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46749217.11128.26597.exe"
    3⤵
    - Blocklisted process makes network request
    PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-60-0x00000000768B1000-0x00000000768B3000-memory.dmp

Filesize
8KB

Download
memory/1200-61-0x0000000000220000-0x000000000029B000-memory.dmp

Filesize
492KB

Download
memory/1200-64-0x0000000001FC0000-0x0000000002140000-memory.dmp

Filesize
1.5MB

Download
memory/1200-68-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download
memory/1200-67-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1200-69-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1256-70-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/1972-65-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1972-66-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing