parallax | 88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e

Analysis

max time kernel
130s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-05-2022 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe
Size

368KB
MD5

83105323fc94c3501160918c1ba9c808
SHA1

f4487411e8a277c40eb1005416029b9d7d58c46c
SHA256

88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e
SHA512

86c2e89813b400c896af55d3f6b4a0e6749de674cdc363e95bb1d65cfcd0a1bc454bec2d2617edbbe37838828f4ca3ba523a55a8982c2d061efa70131fdb831d

Score

10^/10

parallax persistence rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/3768-135-0x0000000000400000-0x000000000042B000-memory.dmp	parallax_rat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OgdcS = "C:\\Users\\Admin\\AppData\\Local\\OgdcSI\\OgdcSIvSk.hta"	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 3768	2404	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	63

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2404	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3768	2404	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	63
PID 2404 wrote to memory of 3768	2404	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	63
PID 2404 wrote to memory of 3768	2404	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	63
PID 2404 wrote to memory of 3768	2404	88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe	63

C:\Users\Admin\AppData\Local\Temp\88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe
"C:\Users\Admin\AppData\Local\Temp\88477944391273032e6d823165775f6bd063b938f23969c4d2bb9fbe0dfed52e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"
  2⤵
  PID:3768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-130-0x00000000009B0000-0x0000000000A12000-memory.dmp

Filesize
392KB

Download
memory/2404-131-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/2404-132-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/2404-134-0x0000000005480000-0x0000000005483000-memory.dmp

Filesize
12KB

Download
memory/3768-135-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download