Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe
-
Size
353KB
-
MD5
edf0159d911a602c67e67fa23e414b12
-
SHA1
a34ca73bc3366ac59e46ba97e39967bb8d660b09
-
SHA256
80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d
-
SHA512
247b6e7512fc4ab3705d78474c821835f9419ffb146528805a3a570d91b9957d4de49539c440c3ef2675a6ec3cfeffdd591536f1584a46ca039a27fbc8078739
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1592-77-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Executes dropped EXE 1 IoCs
pid Process 1352 hams.exe -
Loads dropped DLL 3 IoCs
pid Process 1432 80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe 1432 80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe 1352 hams.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1352 hams.exe 1352 hams.exe 1352 hams.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1352 hams.exe 1352 hams.exe 1352 hams.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1432 wrote to memory of 1352 1432 80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe 27 PID 1432 wrote to memory of 1352 1432 80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe 27 PID 1432 wrote to memory of 1352 1432 80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe 27 PID 1432 wrote to memory of 1352 1432 80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe 27 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 1312 1352 hams.exe 28 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 844 1352 hams.exe 29 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30 PID 1352 wrote to memory of 1592 1352 hams.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe"C:\Users\Admin\AppData\Local\Temp\80ca907be8f224f68a5f3cfae36fc2bd961d927d9a5536ed5aeae1f350b30a1d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\hams.exeC:\Users\Admin\AppData\Local\Temp\hams.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:1312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:844
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:1592
-
-