parallax | ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59

Analysis

max time kernel
120s
max time network
138s
platform
windows10_x64
resource
win10-en-20211104
submitted
08/11/2021, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe
Size 3.3MB
Sample211108-ql86rahcdn
SHA256 ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59
MD5 bf815840ff00a0c3ba04d47cc2d158ee
SHA1 c4852fecddf4aa661b46d61866b2b1e8893b5048
SHA512 c8d97bd92e7d873e45b4ea77032d7f6caebb644a361b2bfdc876b66f2925218082107143d0052b2259404fbfd884c3a8665a61f5640c7e6dd825899038281267
MD5 SHA1 SHA512

Score

10^/10

parallax rat spyware stealer

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/2008-202-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
35	2008	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp
3696	wsqmcons.exe

Loads dropped DLL 1 IoCs

pid	Process
3696	wsqmcons.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	mountvol.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\wsqmcons.job	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3696	wsqmcons.exe
528	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
528	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 4032	3732	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe	69
PID 3732 wrote to memory of 4032	3732	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe	69
PID 3732 wrote to memory of 4032	3732	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe	69
PID 4032 wrote to memory of 4092	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	70
PID 4032 wrote to memory of 4092	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	70
PID 4032 wrote to memory of 4092	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	70
PID 4032 wrote to memory of 3968	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	71
PID 4032 wrote to memory of 3968	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	71
PID 4032 wrote to memory of 3968	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	71
PID 4032 wrote to memory of 4356	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	73
PID 4032 wrote to memory of 4356	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	73
PID 4032 wrote to memory of 4356	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	73
PID 4092 wrote to memory of 4456	4092	cmd.exe	76
PID 4092 wrote to memory of 4456	4092	cmd.exe	76
PID 4092 wrote to memory of 4456	4092	cmd.exe	76
PID 4356 wrote to memory of 4512	4356	cmd.exe	77
PID 4356 wrote to memory of 4512	4356	cmd.exe	77
PID 4356 wrote to memory of 4512	4356	cmd.exe	77
PID 4032 wrote to memory of 4488	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	78
PID 4032 wrote to memory of 4488	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	78
PID 4032 wrote to memory of 4488	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	78
PID 4032 wrote to memory of 4516	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	85
PID 4032 wrote to memory of 4516	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	85
PID 4032 wrote to memory of 4516	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	85
PID 4032 wrote to memory of 4396	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	81
PID 4032 wrote to memory of 4396	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	81
PID 4032 wrote to memory of 4396	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	81
PID 4032 wrote to memory of 3272	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	83
PID 4032 wrote to memory of 3272	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	83
PID 4032 wrote to memory of 3272	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	83
PID 4032 wrote to memory of 3696	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	86
PID 4032 wrote to memory of 3696	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	86
PID 4032 wrote to memory of 3696	4032	ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp	86
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87
PID 3696 wrote to memory of 528	3696	wsqmcons.exe	87

C:\Users\Admin\AppData\Local\Temp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe
"C:\Users\Admin\AppData\Local\Temp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\is-B6IDM.tmp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B6IDM.tmp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.tmp" /SL5="$50080,2608320,831488,C:\Users\Admin\AppData\Local\Temp\ab711cdbe0142ca44fc643c6741f396e5d027458253a985a2eb8cd9258f94b59.bin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C mountvol P: /D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\SysWOW64\mountvol.exe
      mountvol P: /D
      4⤵
      Enumerates connected drives
      PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C bcdedit /set {bootmgr} path \EFI\Boot\bareflank.efi
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C setx /m PATH "%PATH%C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\setx.exe
      setx /m PATH "C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp"
      4⤵
      PID:4512
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp\devcon.exe" remove "ROOT\bareflank""
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp\devcon.exe" remove "ROOT\bfbuilder""
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp\devcon.exe" install "C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp\bfbuilder.inf" "ROOT\bfbuilder""
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp\devcon.exe" install "C:\Users\Admin\AppData\Local\Temp\is-BJVL5.tmp\bareflank.inf" "ROOT\bareflank""
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Roaming\wsqmcons.exe
    "C:\Users\Admin\AppData\Roaming\wsqmcons.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:528
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        Blocklisted process makes network request
        Drops file in Windows directory
        
        PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-163-0x0000000002A10000-0x0000000002A18000-memory.dmp

Download

memory/528-150-0x0000000002740000-0x0000000002742000-memory.dmp

Download

memory/528-142-0x0000000077999000-0x000000007799A000-memory.dmp

Download

memory/528-164-0x00007FFABC080000-0x00007FFABC25B000-memory.dmp

Download

memory/2008-172-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/2008-171-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/2008-176-0x00007FFABC080000-0x00007FFABC25B000-memory.dmp

Download

memory/2008-179-0x0000000002E50000-0x0000000002E59000-memory.dmp

Download

memory/2008-202-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3696-139-0x000000000112E000-0x0000000001138000-memory.dmp

Download

memory/3732-120-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4032-123-0x0000000000730000-0x0000000000731000-memory.dmp

Download