Analysis
- max time kernel
151s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
02/05/2022, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe
- Size 645KB
- Sample220502-ccnlsseccl
- SHA256 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
- MD5 e68e0aebbf004b1fd55018a03e3b634f
- SHA1 e97810b8a8f700dc7cdf284e774d74e975686d87
- SHA512 38da5d322a435a5ac2e2f6a322dbbff4f01a2d3a8b639aafde72000126bcfb8937f242570c334c819ad5728c5402cdd97a12750eef37ce8173c3b31950b2498a
- MD5 SHA1 SHA512
Malware Config
Signatures
- ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/1964-133-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssl.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssl.exe DllHost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe"C:\Users\Admin\AppData\Local\Temp\30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exe"C:\Users\Admin\AppData\Local\Temp\30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe"2⤵PID:1964
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:5028