Analysis
- max time kernel
154s - max time network
168s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
271_2019.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 271_2019.exe
- Size 322KB
- Sample220124-ddmassagbk
- SHA256 4722dafde634152e42054038c6ab64563a9dd717edfa2e37f245c76f431cecec
- MD5 7f71353df2ed28ac7dd55b402bb42450
- SHA1 3f31836a1a57673760f5c12866b7fdd7666dac96
- SHA512 4575a3202a820c615a655412e03106330b60b3fa10506ee1c7c7a468ebe6c6e9ecca6fb01fbaf9b3e8ac5e9834abd536fb50b4f73db34dee2b692147b767fc45
- MD5 SHA1 SHA512
Malware Config
Signatures
- ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/1052-149-0x0000000000400000-0x0000000000429000-memory.dmp parallax_rat - Loads dropped DLL 2 IoCs
pid Process 3672 271_2019.exe 3672 271_2019.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini 271_2019.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell 271_2019.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent 271_2019.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell\ = "open" 271_2019.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3672 271_2019.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3672 271_2019.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69 PID 3672 wrote to memory of 1052 3672 271_2019.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\271_2019.exe"C:\Users\Admin\AppData\Local\Temp\271_2019.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:1052
-