Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 01:56
Static task
static1
Behavioral task
behavioral1
Sample
30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe
-
Size
645KB
-
MD5
e68e0aebbf004b1fd55018a03e3b634f
-
SHA1
e97810b8a8f700dc7cdf284e774d74e975686d87
-
SHA256
30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c
-
SHA512
38da5d322a435a5ac2e2f6a322dbbff4f01a2d3a8b639aafde72000126bcfb8937f242570c334c819ad5728c5402cdd97a12750eef37ce8173c3b31950b2498a
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/1964-133-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssl.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssl.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86 PID 3592 wrote to memory of 1964 3592 30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe"C:\Users\Admin\AppData\Local\Temp\30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exe"C:\Users\Admin\AppData\Local\Temp\30296a1aab16dd65d0c66e283833c31b1c77151507ef7201580c35a64b49995c.exe"2⤵PID:1964
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:5028