Analysis
-
max time kernel
101s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
25-08-2021 12:10
Static task
static1
Behavioral task
behavioral1
Sample
389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe
-
Size
13.6MB
-
MD5
415c3aa31822921311e2f080b3814924
-
SHA1
796231aacfe6bf73ac73e95f1f061307f6c3ae68
-
SHA256
389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a
-
SHA512
637b3feb21e3a4fc497faa5e762d843acb3c2e8688f98cc2f30aaf468d9ac10d62dcbc7736baedb43e677674728afea748dc35acaff1c554ac754e5c8a6eff6a
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/1492-196-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Blocklisted process makes network request 1 IoCs
flow pid Process 16 1492 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2136 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.tmp 2056 UtorrentV4.exe -
resource yara_rule behavioral2/files/0x000100000001ab4d-120.dat upx behavioral2/files/0x000100000001ab4d-195.dat upx -
Loads dropped DLL 8 IoCs
pid Process 2056 UtorrentV4.exe 2056 UtorrentV4.exe 2056 UtorrentV4.exe 2056 UtorrentV4.exe 2056 UtorrentV4.exe 2056 UtorrentV4.exe 2056 UtorrentV4.exe 2056 UtorrentV4.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\UtorrentV4.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2056 UtorrentV4.exe 2788 notepad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2788 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 2136 3128 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe 75 PID 3128 wrote to memory of 2136 3128 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe 75 PID 3128 wrote to memory of 2136 3128 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe 75 PID 2136 wrote to memory of 2056 2136 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.tmp 76 PID 2136 wrote to memory of 2056 2136 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.tmp 76 PID 2136 wrote to memory of 2056 2136 389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.tmp 76 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79 PID 2056 wrote to memory of 2788 2056 UtorrentV4.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe"C:\Users\Admin\AppData\Local\Temp\389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\is-S7BP4.tmp\389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.tmp"C:\Users\Admin\AppData\Local\Temp\is-S7BP4.tmp\389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.tmp" /SL5="$20112,13430622,831488,C:\Users\Admin\AppData\Local\Temp\389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Roaming\UtorrentV4.exe"C:\Users\Admin\AppData\Roaming\UtorrentV4.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
- Blocklisted process makes network request
- Drops file in Windows directory
PID:1492
-
-
-
-