parallax | d853393d45fc7123238bf7ce1cc87fbf72fe8aa757a8a3b9b77cd020f3327a25

General

Target

helpdesk1.exe
Size

8.9MB
MD5

69bc1a7ef6055d469db60fde69588129
SHA1

26c869f763a499e59bced14b3f53b54361181b50
SHA256

d853393d45fc7123238bf7ce1cc87fbf72fe8aa757a8a3b9b77cd020f3327a25
SHA512

ce3de41cd8530f14d6162e314b2549e07d4901d600e75742276453a63549a11bbe5c0a970940dba0d12e84cc83424926d0aca6667ccc9a820f852d72560edd55

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 1 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/2028-61-0x0000000000400000-0x0000000000426000-memory.dmp	parallax_rat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vpnd.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe
1532	helpdesk1.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29
PID 1532 wrote to memory of 2028	1532	helpdesk1.exe	29

C:\Users\Admin\AppData\Local\Temp\helpdesk1.exe
"C:\Users\Admin\AppData\Local\Temp\helpdesk1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
  "C:\Users\Admin\AppData\Local\Temp\helpdesk1.exe"
  2⤵
  PID:2028

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-54-0x0000000075581000-0x0000000075583000-memory.dmp

Filesize
8KB

Download
memory/1532-55-0x0000000000D30000-0x0000000000DAB000-memory.dmp

Filesize
492KB

Download
memory/1532-58-0x0000000000D30000-0x0000000000DAB000-memory.dmp

Filesize
492KB

Download
memory/1532-60-0x0000000002610000-0x0000000002790000-memory.dmp

Filesize
1.5MB

Download
memory/2028-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing