parallax | 152cd4630ca5b31679f9af5b5226869962d0631276a3b9ab3af71bbe5c87ab46

Analysis

max time kernel
147s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
06-05-2022 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scribe.exe
Size

2.0MB
MD5

a0fc62c608603f02cae7a7103625cbca
SHA1

2c6961b447b9b20aca8da625923568e79f40066f
SHA256

152cd4630ca5b31679f9af5b5226869962d0631276a3b9ab3af71bbe5c87ab46
SHA512

9a441c607ef833632e37db705d03c5cec147659b07548eb2c2f46f047d3425110787b9675e91eb5196897e32eedecdc5bf96f5fd681e5d6ed86831ed3af54a5f

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/1364-132-0x0000000000400000-0x0000000000690000-memory.dmp	parallax_rat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\carlreciver.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\carlreciver.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe
1364	Scribe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	Scribe.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3132	1364	Scribe.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3132
- C:\Users\Admin\AppData\Local\Temp\Scribe.exe
  "C:\Users\Admin\AppData\Local\Temp\Scribe.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1364

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-130-0x0000000000830000-0x00000000008AB000-memory.dmp

Filesize
492KB

Download
memory/1364-131-0x0000000002480000-0x0000000002623000-memory.dmp

Filesize
1.6MB

Download
memory/1364-132-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download