Analysis
-
max time kernel
152s -
max time network
168s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:53
Static task
static1
Behavioral task
behavioral1
Sample
271_2019.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
271_2019.exe
-
Size
322KB
-
MD5
7f71353df2ed28ac7dd55b402bb42450
-
SHA1
3f31836a1a57673760f5c12866b7fdd7666dac96
-
SHA256
4722dafde634152e42054038c6ab64563a9dd717edfa2e37f245c76f431cecec
-
SHA512
4575a3202a820c615a655412e03106330b60b3fa10506ee1c7c7a468ebe6c6e9ecca6fb01fbaf9b3e8ac5e9834abd536fb50b4f73db34dee2b692147b767fc45
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1464-69-0x0000000000400000-0x0000000000429000-memory.dmp parallax_rat -
Loads dropped DLL 2 IoCs
pid Process 1116 271_2019.exe 1116 271_2019.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini 271_2019.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell 271_2019.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent 271_2019.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell\ = "open" 271_2019.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1116 271_2019.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1116 271_2019.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27 PID 1116 wrote to memory of 1464 1116 271_2019.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\271_2019.exe"C:\Users\Admin\AppData\Local\Temp\271_2019.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:1464
-