Analysis
-
max time kernel
4294218s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 20:23
Static task
static1
Behavioral task
behavioral1
Sample
a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
-
Target
a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe
-
Size
272KB
-
MD5
c732e315809bf9f1cd03183a937d072b
-
SHA1
b6ebe91824977c6f8b1167dd243a34120fe5c005
-
SHA256
a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265
-
SHA512
d4e7b096798a338fbb8bc23053f6e1932cada822c9c24dd1805708a771593b2a7a1503f2a2f6b777cf7c4a0c584e4608b2f2c1b06a01542f34d37108f9aaa458
Malware Config
Signatures
-
ParallaxRat payload 5 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1592-63-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/1592-65-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/1592-67-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/1592-69-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/1592-71-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2020 set thread context of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27 PID 2020 wrote to memory of 1592 2020 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"2⤵PID:1592
-