parallax | a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f

Analysis

max time kernel
152s
max time network
139s
platform
windows7_x64
resource
win7-en-20211208
submitted
06-02-2022 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe
Size

131KB
MD5

1a4a9f4727863df927b47392049d9c9f
SHA1

d15e4eae9cce74b481b1c5aacdcccacb7ec07a6f
SHA256

a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f
SHA512

71d0274e2d1cccb6ef0870a2518c09801e5ee65fd8b403266100a0892b51682557f0c87bc08f1f16a239ed54d46a2e4ad08c16c2c0a0e5508e3ed246d014f3f3

Score

10^/10

parallax persistence rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/files/0x000700000001220d-56.dat	parallax_rat

Executes dropped EXE 1 IoCs

pid	Process
2008	Auto KMS Service.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Auto KMS Svc = "C:\\Users\\Admin\\AppData\\Roaming\\KMS\\Auto KMS Service.exe"	Auto KMS Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1364	a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2008	Auto KMS Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2008	1364	a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe	27
PID 1364 wrote to memory of 2008	1364	a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe	27
PID 1364 wrote to memory of 2008	1364	a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe	27
PID 1364 wrote to memory of 2008	1364	a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe	27

C:\Users\Admin\AppData\Local\Temp\a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe
"C:\Users\Admin\AppData\Local\Temp\a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Roaming\KMS\Auto KMS Service.exe
  "C:\Users\Admin\AppData\Roaming\KMS\Auto KMS Service.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: SetClipboardViewer
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download