parallax | 2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-en-20211208
submitted
06-02-2022 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe
Size

131KB
MD5

1538a7e26ee76f01d4db6c37f66223a8
SHA1

4c547aa3f4e4008f9463957c846266a8f6645677
SHA256

2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233
SHA512

c93f9bb26532a35a1a5b4166218be1d28e1c4b10ddf15cb65108eb532c6d1817a2b0120bd9e5d5ab3464f8af7f146cf524bc36757665316dba2b469518a0c4ec

Score

10^/10

parallax persistence rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/files/0x000700000001220d-55.dat	parallax_rat

Executes dropped EXE 1 IoCs

pid	Process
1648	UPX_Compiler.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UPX = "C:\\Users\\Admin\\AppData\\Roaming\\VBS-Crypter\\UPX_Compiler.exe"	UPX_Compiler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1376	2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1648	UPX_Compiler.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1648	1376	2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe	27
PID 1376 wrote to memory of 1648	1376	2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe	27
PID 1376 wrote to memory of 1648	1376	2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe	27
PID 1376 wrote to memory of 1648	1376	2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe	27

C:\Users\Admin\AppData\Local\Temp\2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe
"C:\Users\Admin\AppData\Local\Temp\2793e5e5c6dabf88d5bebe53dd5a5bd8ecad007d290dd64901a6fc06cb439233.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Roaming\VBS-Crypter\UPX_Compiler.exe
  "C:\Users\Admin\AppData\Roaming\VBS-Crypter\UPX_Compiler.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: SetClipboardViewer
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download