parallax | 0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74

Analysis

max time kernel
165s
max time network
189s
platform
windows7_x64
resource
win7-en-20211208
submitted
17-02-2022 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe
Size

411KB
MD5

75c167de4b7f43468462a76d8e7a38e5
SHA1

50edb9a411038983e8650d2feaaa83c9fb041ea0
SHA256

0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74
SHA512

4e1d8c3778edde0bf2b1fdcf78fa87a9497a27a109666c22ddb264d2abfaeec015d3103a42bf1745a922aae0f2fb15700e834f95854856a6b05be193b50f6387

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StreamWorks.exe	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StreamWorks.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1500	964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe	28
PID 964 wrote to memory of 1500	964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe	28
PID 964 wrote to memory of 1500	964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe	28
PID 964 wrote to memory of 1500	964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe	28
PID 964 wrote to memory of 1500	964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe	28
PID 964 wrote to memory of 1500	964	0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe	28

C:\Users\Admin\AppData\Local\Temp\0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe
"C:\Users\Admin\AppData\Local\Temp\0a689281e5c807412fd9fca5f4a2d02f90e149da1ecc16179a09d88fa88eed74.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\WerFault.exe
  "C:\Windows\System32\WerFault.exe"
  2⤵
  PID:1500

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x0000000000431000-0x000000000043A000-memory.dmp

Filesize
36KB

Download
memory/964-55-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download