Analysis
-
max time kernel
182s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
19-03-2022 20:23
Static task
static1
Behavioral task
behavioral1
Sample
a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
-
Target
a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe
-
Size
272KB
-
MD5
c732e315809bf9f1cd03183a937d072b
-
SHA1
b6ebe91824977c6f8b1167dd243a34120fe5c005
-
SHA256
a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265
-
SHA512
d4e7b096798a338fbb8bc23053f6e1932cada822c9c24dd1805708a771593b2a7a1503f2a2f6b777cf7c4a0c584e4608b2f2c1b06a01542f34d37108f9aaa458
Malware Config
Signatures
-
ParallaxRat payload 2 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/1504-144-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/1504-145-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4880 set thread context of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87 PID 4880 wrote to memory of 1504 4880 a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"C:\Users\Admin\AppData\Local\Temp\a5c234ea0a6c7f122052c13209048e68ec41fdf8cccb532b2b50b59953f6d265.exe"2⤵PID:1504
-