Analysis

  • max time kernel
    165s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-03-2022 20:29

General

  • Target

    5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe

  • Size

    4.9MB

  • MD5

    20895e7661c07d7668e22bf5865a75be

  • SHA1

    f1783b80c5f2cd2ca1771a238015f8b2846610c6

  • SHA256

    5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c

  • SHA512

    ff06ee5df939b6b03d8ea8509cff28d103b2c8e1bf804b4e17942b29302b80d695cdb6e51b91d1991c6c7654e3c96c59b2b012fc4d8088dbed847510973dad18

Score
10/10

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • ParallaxRat payload 1 IoCs

    Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe
    "C:\Users\Admin\AppData\Local\Temp\5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\calc.exe
      "C:\Users\Admin\AppData\Local\Temp\5fb4e62ccca93a45b7c8ec2734d3388b94698e0ce04d72b1fa2e8c162618d15c.exe"
      2⤵
        PID:4372

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2380-130-0x0000000002520000-0x000000000259B000-memory.dmp

      Filesize

      492KB

    • memory/2380-131-0x0000000077210000-0x00000000773B3000-memory.dmp

      Filesize

      1.6MB

    • memory/2380-132-0x00000000025B0000-0x0000000002753000-memory.dmp

      Filesize

      1.6MB

    • memory/4372-134-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

      Filesize

      4KB

    • memory/4372-135-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4372-133-0x0000000077210000-0x00000000773B3000-memory.dmp

      Filesize

      1.6MB