Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
MAILPRIN.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MAILPRIN.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
MAILPRIN.exe
-
Size
3.6MB
-
MD5
f3657fe3d3aa2264fc487d7d2e35a06a
-
SHA1
85c5b30ebe711953857cc6d5e5c52dc51786c518
-
SHA256
0232fe4b3256a6a4700de482e5e9074baf4548d7604cf4404182be73353ee32f
-
SHA512
f4a1186373821716e75b85405d7e31938902e9d1774d5c897f16baeb31bb0d227406011e6e462875c4a29ebbd85961213b98c780bf80a0e4a54bbbde61236cf4
Malware Config
Signatures
-
ParallaxRat payload 2 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1692-58-0x0000000000400000-0x000000000042B000-memory.dmp parallax_rat behavioral1/memory/1692-41024-0x0000000000401000-0x000000000040B000-memory.dmp parallax_rat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobessl.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1820 1692 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe 1892 MAILPRIN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28 PID 1892 wrote to memory of 1692 1892 MAILPRIN.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAILPRIN.exe"C:\Users\Admin\AppData\Local\Temp\MAILPRIN.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\calc.execalc.exe2⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 1323⤵
- Program crash
PID:1820
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:872