Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-06-2022 11:44
Static task
static1
Behavioral task
behavioral1
Sample
PhotoPad.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
PhotoPad.exe
-
Size
8.7MB
-
MD5
8b3e138741dd81aab4073a6b2fa350b5
-
SHA1
d93c39a4861a899190d9e7fbea1f19c01d7b23f6
-
SHA256
4c19118800b3e0e5897312c9aa2196bd44e48b72ec4c486c3e71dc56178eb2a5
-
SHA512
de3a6a99982cd45b844f4bbcb2d4067187bea72eb1b57cb9b448dd2a4ad5aacb0a7c8a6b8dca024783ed9b8cad24301402eab7af212fdbaa19e577a6e28a461b
Malware Config
Signatures
-
ParallaxRat payload 2 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/2316-134-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral2/memory/2316-135-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pstd.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pstd.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe 4948 PhotoPad.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82 PID 4948 wrote to memory of 2316 4948 PhotoPad.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\PhotoPad.exe"C:\Users\Admin\AppData\Local\Temp\PhotoPad.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\PhotoPad.exe"2⤵PID:2316
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:976