Analysis
-
max time kernel
13s -
max time network
135s -
platform
windows10_x64 -
resource
win10-en -
submitted
01-09-2021 20:05
Static task
static1
Behavioral task
behavioral1
Sample
b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe
-
Size
491KB
-
MD5
0b8b808ee70becf682a94715f091e8f7
-
SHA1
f9a73fee90079338f2ef10a3c1513f3e13ace777
-
SHA256
b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638
-
SHA512
7bbad7be37f871e04dd454b14b5fc09921bc59e6e17da8c79e5beb2bc33760fefff9d1ba37d43b8aafd5522c9dd38f89bb558c4b4eb304d33bfb0f92de0edefc
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/3672-123-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3996 wrote to memory of 3324 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 76 PID 3996 wrote to memory of 3324 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 76 PID 3996 wrote to memory of 3324 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 76 PID 3996 wrote to memory of 3664 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 77 PID 3996 wrote to memory of 3664 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 77 PID 3996 wrote to memory of 3664 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 77 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78 PID 3996 wrote to memory of 3672 3996 b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"2⤵PID:3324
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"2⤵PID:3664
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\b4010bf318221741f9b99ce7b4cc297c865bba0462f5b6a207b3b6c545658638.exe"2⤵PID:3672
-