Analysis
- max time kernel
13s - max time network
135s - platform
windows10_x64 - resource
win10-en - submitted
01/09/2021, 20:05
Static task
static1
Behavioral task
behavioral1
Sample
b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe
- Size 491KB
- Sample210901-vbcehn3lv6
- SHA256 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638
- MD5 0b8b808ee70becf682a94715f091e8f7
- SHA1 f9a73fee90079338f2ef10a3c1513f3e13ace777
- SHA512 7bbad7be37f871e04dd454b14b5fc09921bc59e6e17da8c79e5beb2bc33760fefff9d1ba37d43b8aafd5522c9dd38f89bb558c4b4eb304d33bfb0f92de0edefc
- MD5 SHA1 SHA512
Malware Config
Signatures
- ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/3672-123-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3996 wrote to memory of 3324 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 76 PID 3996 wrote to memory of 3324 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 76 PID 3996 wrote to memory of 3324 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 76 PID 3996 wrote to memory of 3664 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 77 PID 3996 wrote to memory of 3664 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 77 PID 3996 wrote to memory of 3664 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 77 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"2⤵PID:3324
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"2⤵PID:3664
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"2⤵PID:3672
-