parallax | 88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e

General

Target

88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe
Size

368KB
MD5

83105323fc94c3501160918c1ba9c808
SHA1

f4487411e8a277c40eb1005416029b9d7d58c46c
SHA256

88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e
SHA512

86c2e89813b400c896af55d3f6b4a0e6749de674cdc363e95bb1d65cfcd0a1bc454bec2d2617edbbe37838828f4ca3ba523a55a8982c2d061efa70131fdb831d

Score

10^/10

parallax persistence rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1376-60-0x0000000000400000-0x000000000042B000-memory.dmp	parallax_rat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\OgdcS = "C:\\Users\\Admin\\AppData\\Local\\OgdcSI\\OgdcSIvSk.hta"	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27
PID 880 wrote to memory of 1376	880	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	27

C:\Users\Admin\AppData\Local\Temp\88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe
"C:\Users\Admin\AppData\Local\Temp\88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"
  2⤵
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x00000000009C0000-0x0000000000A22000-memory.dmp

Filesize
392KB

Download
memory/880-55-0x0000000000420000-0x0000000000450000-memory.dmp

Filesize
192KB

Download
memory/880-56-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/880-59-0x0000000000500000-0x0000000000503000-memory.dmp

Filesize
12KB

Download
memory/1376-58-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1376-60-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing