Analysis
-
max time kernel
120s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
08-11-2021 13:22
Static task
static1
Behavioral task
behavioral1
Sample
ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe
-
Size
3.3MB
-
MD5
bf815840ff00a0c3ba04d47cc2d158ee
-
SHA1
c4852fecddf4aa661b46d61866b2b1e8893b5048
-
SHA256
ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59
-
SHA512
c8d97bd92e7d873e45b4ea77032d7f6caebb644a361b2bfdc876b66f2925218082107143d0052b2259404fbfd884c3a8665a61f5640c7e6dd825899038281267
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1316-96-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Blocklisted process makes network request 4 IoCs
flow pid Process 8 1708 cmd.exe 10 1708 cmd.exe 12 1708 cmd.exe 14 1316 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 1764 wsqmcons.exe -
Loads dropped DLL 3 IoCs
pid Process 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 1764 wsqmcons.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: mountvol.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\wsqmcons.job cmd.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 cmd.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f cmd.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1764 wsqmcons.exe 1708 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1708 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 1648 wrote to memory of 796 1648 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe 28 PID 796 wrote to memory of 528 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 29 PID 796 wrote to memory of 528 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 29 PID 796 wrote to memory of 528 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 29 PID 796 wrote to memory of 528 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 29 PID 796 wrote to memory of 1432 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 30 PID 796 wrote to memory of 1432 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 30 PID 796 wrote to memory of 1432 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 30 PID 796 wrote to memory of 1432 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 30 PID 796 wrote to memory of 876 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 32 PID 796 wrote to memory of 876 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 32 PID 796 wrote to memory of 876 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 32 PID 796 wrote to memory of 876 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 32 PID 876 wrote to memory of 436 876 cmd.exe 36 PID 876 wrote to memory of 436 876 cmd.exe 36 PID 876 wrote to memory of 436 876 cmd.exe 36 PID 876 wrote to memory of 436 876 cmd.exe 36 PID 528 wrote to memory of 1156 528 cmd.exe 35 PID 528 wrote to memory of 1156 528 cmd.exe 35 PID 528 wrote to memory of 1156 528 cmd.exe 35 PID 528 wrote to memory of 1156 528 cmd.exe 35 PID 796 wrote to memory of 1172 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 37 PID 796 wrote to memory of 1172 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 37 PID 796 wrote to memory of 1172 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 37 PID 796 wrote to memory of 1172 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 37 PID 796 wrote to memory of 1148 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 39 PID 796 wrote to memory of 1148 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 39 PID 796 wrote to memory of 1148 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 39 PID 796 wrote to memory of 1148 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 39 PID 796 wrote to memory of 1288 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 40 PID 796 wrote to memory of 1288 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 40 PID 796 wrote to memory of 1288 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 40 PID 796 wrote to memory of 1288 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 40 PID 796 wrote to memory of 1504 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 42 PID 796 wrote to memory of 1504 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 42 PID 796 wrote to memory of 1504 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 42 PID 796 wrote to memory of 1504 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 42 PID 796 wrote to memory of 1764 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 45 PID 796 wrote to memory of 1764 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 45 PID 796 wrote to memory of 1764 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 45 PID 796 wrote to memory of 1764 796 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp 45 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46 PID 1764 wrote to memory of 1708 1764 wsqmcons.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe"C:\Users\Admin\AppData\Local\Temp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\is-D90KN.tmp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp"C:\Users\Admin\AppData\Local\Temp\is-D90KN.tmp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp" /SL5="$50118,2608320,831488,C:\Users\Admin\AppData\Local\Temp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mountvol P: /D3⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\mountvol.exemountvol P: /D4⤵
- Enumerates connected drives
PID:1156
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C bcdedit /set {bootmgr} path \EFI\Boot\bareflank.efi3⤵PID:1432
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C setx /m PATH "%PATH%C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp"3⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\setx.exesetx /m PATH "C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp"4⤵PID:436
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp\devcon.exe" remove "ROOT\bareflank""3⤵PID:1172
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp\devcon.exe" install "C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp\bareflank.inf" "ROOT\bareflank""3⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp\devcon.exe" remove "ROOT\bfbuilder""3⤵PID:1288
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp\devcon.exe" install "C:\Users\Admin\AppData\Local\Temp\is-OU9T8.tmp\bfbuilder.inf" "ROOT\bfbuilder""3⤵PID:1504
-
-
C:\Users\Admin\AppData\Roaming\wsqmcons.exe"C:\Users\Admin\AppData\Roaming\wsqmcons.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
- Blocklisted process makes network request
- Drops file in Windows directory
PID:1316
-
-
-
-