Overview

overview

10

Static

static

2622016be3...af.exe

windows7_x64

10

2622016be3...af.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    178s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-05-2022 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe

  • Size

    740KB

  • MD5

    18551ecce3d3f037804002709354d12c

  • SHA1

    0121223d675ac59d22e27efc5f0ce2d456c03bb0

  • SHA256

    2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af

  • SHA512

    ff15a0b891a587e33b4a8334cbcdfb12a875660bc8c87d50751c3b38e4491d7d41b1be6383b671c7fd238211f14bbaf145963c5bd2581773344e1e2250b6a83f

Score
10/10
parallaxrat

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

    ratparallax
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe
    "C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe
      "C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe"
      2⤵
        PID:4428

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2068-131-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

      Download