parallax | d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc

General

Target

d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe
Size

2.2MB
MD5

e50d6088d72b8b7bde335e1522517479
SHA1

8f036b44bf4e93abc1b4691f7f663b2a0b782c09
SHA256

d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc
SHA512

a554951d32cd1b876d42033a83e0e3abb1c1c1a6fca81870521a2b6965a7c938863b7816e83a067553c7beca18825699a805b0a8b11626512f549d89848a3dd1

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/3656-124-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2100	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	69
PID 3628 wrote to memory of 2100	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	69
PID 3628 wrote to memory of 2100	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	69
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70
PID 3628 wrote to memory of 3656	3628	d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe	70

C:\Users\Admin\AppData\Local\Temp\d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe
"C:\Users\Admin\AppData\Local\Temp\d327f4e4f6c73e96c204d77355171ca6fd7b29c54b234f0bdf97398e04179edc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2100
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3628-118-0x0000000000400000-0x0000000000642000-memory.dmp

Filesize
2.3MB

Download
memory/3656-119-0x00000000027F0000-0x00000000027F2000-memory.dmp

Filesize
8KB

Download
memory/3656-121-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/3656-122-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/3656-124-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3656-123-0x00000000027F0000-0x00000000027F2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing