parallax | 05e25668ecab07ba2dd341f257809f1f2c8cd7ce40c292dd68fe5d084e6e7d3c

Analysis

max time kernel
21s
max time network
165s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INQUIRY_.exe
Size

355KB
MD5

50ad2932e2e76773f14886ce03dc8d19
SHA1

1d16cca7e71e36d76d0d22395bb3d60ae9db0f48
SHA256

3bd7eae6d409d1654f4317994ec8311946d96737f1c9042ff1fc5b8fb089d549
SHA512

f64db23ae8dc25ece8292d4b1231e8e1d60f4185cd66e999c794a3f9571e4ba1c4764158f506baf1636a4e539f22bea4cfd5b5173483f205dec36775deb41eea

Score

10^/10

parallax discovery rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/304-70-0x0000000000400000-0x0000000000429000-memory.dmp	parallax_rat

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\INQUIRY_.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY_.exe"
1⤵
PID:1540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-63-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/304-64-0x0000000077610000-0x00000000777B9000-memory.dmp

Filesize
1.7MB

Download
memory/304-70-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1540-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1540-57-0x0000000039160000-0x0000000039176000-memory.dmp

Filesize
88KB

Download
memory/1540-59-0x0000000039180000-0x0000000039185000-memory.dmp

Filesize
20KB

Download
memory/1540-60-0x0000000039190000-0x0000000039191000-memory.dmp

Filesize
4KB

Download
memory/1540-61-0x0000000077610000-0x00000000777B9000-memory.dmp

Filesize
1.7MB

Download
memory/1540-62-0x00000000391C0000-0x00000000391E1000-memory.dmp

Filesize
132KB

Download