Overview

overview

10

Static

static

e977ecbe53...9a.exe

windows7_x64

10

e977ecbe53...9a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e977ecbe535a71569be5143bb4f1a2868e45e5251903fb2640c1a48dcd18cc9a

  • Size

    8.3MB

  • Sample

    211021-llgpaaaher

  • MD5

    ccd06635e00d0387499240fba7bc3559

  • SHA1

    37c6ecc5808fa6b73fe8855b0c28cabbe7a69956

  • SHA256

    e977ecbe535a71569be5143bb4f1a2868e45e5251903fb2640c1a48dcd18cc9a

  • SHA512

    dc371226c37b324168652c166b9d532104875b10dc05a7eda522e43a8921a952d4877722268bf4dfe5016d2be88e88c6d8e4f65d8c5c50f708b86b487c94f17d

Score
10/10
parallaxevasionransomwareratspywarestealersuricata

Malware Config

Targets

    • Target

      e977ecbe535a71569be5143bb4f1a2868e45e5251903fb2640c1a48dcd18cc9a

    • Size

      8.3MB

    • MD5

      ccd06635e00d0387499240fba7bc3559

    • SHA1

      37c6ecc5808fa6b73fe8855b0c28cabbe7a69956

    • SHA256

      e977ecbe535a71569be5143bb4f1a2868e45e5251903fb2640c1a48dcd18cc9a

    • SHA512

      dc371226c37b324168652c166b9d532104875b10dc05a7eda522e43a8921a952d4877722268bf4dfe5016d2be88e88c6d8e4f65d8c5c50f708b86b487c94f17d

    Score
    10/10
    parallaxevasionransomwareratspywarestealersuricata

    • ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • suricata: ET MALWARE Parallax CnC Response Activity M14

      suricata: ET MALWARE Parallax CnC Response Activity M14

      suricata

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Tasks