parallax | 88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5

Analysis

max time kernel
146s
max time network
157s
platform
windows7_x64
resource
win7v20210408
submitted
06-09-2021 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe
Size

10.1MB
MD5

5869105d4b319a612a5e25fa265fd85d
SHA1

6988b2e332875d33524fdb2b7c63001f8a064fe7
SHA256

88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5
SHA512

735dd900728415dc25ea99c49f1dd49ceb9a02116f17333ff313fc8519aa7c5be12c8898be632eba473a7afa26f7e70f87f2396903b5e777d12d158078e63dc2

Score

10^/10

parallax rat upx

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1956-94-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Executes dropped EXE 2 IoCs

pid	Process
1364	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp
1576	winhlp.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00030000000130db-68.dat	upx
behavioral1/files/0x00030000000130db-70.dat	upx
behavioral1/files/0x00030000000130db-93.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe
1364	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp
1576	winhlp.exe
1576	winhlp.exe
1576	winhlp.exe
1576	winhlp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\winhlp.job	notepad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1576	winhlp.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe
740	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1920 wrote to memory of 1364	1920	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe	26
PID 1364 wrote to memory of 1576	1364	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp	30
PID 1364 wrote to memory of 1576	1364	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp	30
PID 1364 wrote to memory of 1576	1364	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp	30
PID 1364 wrote to memory of 1576	1364	88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp	30
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 1576 wrote to memory of 740	1576	winhlp.exe	31
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 1556	740	dllhost.exe	34
PID 740 wrote to memory of 308	740	dllhost.exe	35
PID 740 wrote to memory of 308	740	dllhost.exe	35
PID 740 wrote to memory of 308	740	dllhost.exe	35
PID 740 wrote to memory of 308	740	dllhost.exe	35
PID 740 wrote to memory of 308	740	dllhost.exe	35

C:\Users\Admin\AppData\Local\Temp\88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\is-LFK52.tmp\88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LFK52.tmp\88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.tmp" /SL5="$5015C,9529176,831488,C:\Users\Admin\AppData\Local\Temp\88c109e8bca8a35c02efa6ce6f27bb714d16623382cd8181011e8776c5f017a5.bin.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Roaming\winhlp.exe
    "C:\Users\Admin\AppData\Roaming\winhlp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1556
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:308
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:2044
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1856
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        
        PID:1084
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        Drops file in Windows directory
        
        PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-84-0x0000000077590000-0x0000000077739000-memory.dmp

Filesize
1.7MB

Download
memory/740-82-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/740-83-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/1364-67-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1920-66-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1920-60-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1956-87-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1956-86-0x0000000077590000-0x0000000077739000-memory.dmp

Filesize
1.7MB

Download
memory/1956-88-0x0000000077591000-0x000000007769127A-memory.dmp

Filesize
1.0MB

Download
memory/1956-94-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download