parallax | 464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e | Triage

Analysis

max time kernel
151s
max time network
177s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-01-2022 18:31

Sharing

Report Analysis Logs

General

Target

464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
Size

374KB
MD5

552fcd0a37433a3dcaedeaafe8666f69
SHA1

4af62f9021e86e30be1bc31c2113e0c1e019aa14
SHA256

464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e
SHA512

eb44f3ca0cca6840d70f9f76b59fcca81adad3c9a196768db9279e5cd355778d0628831be306221841826dc47d3108a2687dc0355cb02218e78a1124bbf34a39

Score

10^/10

parallax persistence rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\securityScan = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\securityScan.exe"	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe

C:\Users\Admin\AppData\Local\Temp\464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe
"C:\Users\Admin\AppData\Local\Temp\464260a1d72bc3ce079353ddec92e05339253ab577956f3736d94b917bcda91e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-115-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download