parallax | 5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c

General

Target

5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
Size

4.9MB
MD5

20895e7661c07d7668e22bf5865a75be
SHA1

f1783b80c5f2cd2ca1771a238015f8b2846610c6
SHA256

5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c
SHA512

ff06ee5df939b6b03d8ea8509cff28d103b2c8e1bf804b4e17942b29302b80d695cdb6e51b91d1991c6c7654e3c96c59b2b012fc4d8088dbed847510973dad18

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/456-61-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29
PID 792 wrote to memory of 456	792	5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe	29

C:\Users\Admin\AppData\Local\Temp\5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
"C:\Users\Admin\AppData\Local\Temp\5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\calc.exe
  "C:\Users\Admin\AppData\Local\Temp\5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe"
  2⤵
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-60-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/456-57-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/456-59-0x0000000077DD0000-0x0000000077F50000-memory.dmp

Filesize
1.5MB

Download
memory/456-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/456-62-0x0000000076AC1000-0x0000000076AC3000-memory.dmp

Filesize
8KB

Download
memory/792-54-0x00000000002A0000-0x000000000031B000-memory.dmp

Filesize
492KB

Download
memory/792-55-0x0000000077DD0000-0x0000000077F50000-memory.dmp

Filesize
1.5MB

Download
memory/792-56-0x0000000002150000-0x00000000022D0000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing