parallax | 3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654

Analysis

max time kernel
145s
max time network
144s
platform
windows7_x64
resource
win7-en-20210920
submitted
06-10-2021 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe
Size

7.1MB
MD5

4866d86370233b82ff2b0017221c57e2
SHA1

063628db0dab74df343232a6670ee477d29e1219
SHA256

3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654
SHA512

14d061b783542303e360f19c754ecdb69f7d172c70d1156c13cac3020c014f30bff83a53e8ab4a282e0a50eedd5f12bee02c7b681f47d70c2c646e9d1a2a4b23

Score

10^/10

parallax rat upx

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1716-87-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Executes dropped EXE 2 IoCs

pid	Process
1316	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp
1616	winhlp.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001264c-61.dat	upx
behavioral1/files/0x000500000001264c-63.dat	upx
behavioral1/files/0x000500000001264c-86.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe
1316	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp
1616	winhlp.exe
1616	winhlp.exe
1616	winhlp.exe
1616	winhlp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\winhlp.job	notepad.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1616	winhlp.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe
1660	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1564 wrote to memory of 1316	1564	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe	27
PID 1316 wrote to memory of 1616	1316	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp	28
PID 1316 wrote to memory of 1616	1316	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp	28
PID 1316 wrote to memory of 1616	1316	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp	28
PID 1316 wrote to memory of 1616	1316	3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp	28
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1616 wrote to memory of 1660	1616	winhlp.exe	29
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1684	1660	dllhost.exe	32
PID 1660 wrote to memory of 1828	1660	dllhost.exe	33
PID 1660 wrote to memory of 1828	1660	dllhost.exe	33
PID 1660 wrote to memory of 1828	1660	dllhost.exe	33
PID 1660 wrote to memory of 1828	1660	dllhost.exe	33
PID 1660 wrote to memory of 1828	1660	dllhost.exe	33

C:\Users\Admin\AppData\Local\Temp\3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe
"C:\Users\Admin\AppData\Local\Temp\3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\is-NVUD1.tmp\3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NVUD1.tmp\3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.tmp" /SL5="$60156,6386844,831488,C:\Users\Admin\AppData\Local\Temp\3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Users\Admin\AppData\Roaming\winhlp.exe
    "C:\Users\Admin\AppData\Roaming\winhlp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1660
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1684
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1828
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        
        PID:868
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        
        PID:1092
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        
        PID:1052
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        
        PID:1816
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        5⤵
        Drops file in Windows directory
        
        PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-60-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1564-53-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/1564-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1660-76-0x0000000000790000-0x00000000007C5000-memory.dmp

Filesize
212KB

Download
memory/1660-75-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1660-77-0x0000000077010000-0x00000000771B9000-memory.dmp

Filesize
1.7MB

Download
memory/1716-79-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1716-80-0x0000000077010000-0x00000000771B9000-memory.dmp

Filesize
1.7MB

Download
memory/1716-81-0x0000000077011000-0x000000007711127A-memory.dmp

Filesize
1.0MB

Download
memory/1716-87-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download