Analysis
- max time kernel
138s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
23/06/2022, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe
- Size 901KB
- Sample220623-vsrmhahad4
- SHA256 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c
- MD5 ebbd33c7be8cef4f425574a4c15827db
- SHA1 26153e583034fca53f3ec71dd8a7cbb142b93dc3
- SHA512 6902bb542bd0d175a38236821e9cfe3e4f9cf9eaf4b549e8d3eaf71814b521edd49afc04770324edaca3f55ce322b3271a7186219530b2754676155c1da9a03c
- MD5 SHA1 SHA512
Malware Config
Signatures
- ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/1016-140-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat - Executes dropped EXE 1 IoCs
pid Process 3512 VfjNv.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4172 wrote to memory of 3512 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 90 PID 4172 wrote to memory of 3512 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 90 PID 4172 wrote to memory of 3512 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 90 PID 4172 wrote to memory of 4652 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 91 PID 4172 wrote to memory of 4652 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 91 PID 4172 wrote to memory of 4652 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 91 PID 4172 wrote to memory of 4568 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 92 PID 4172 wrote to memory of 4568 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 92 PID 4172 wrote to memory of 4568 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 92 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93 PID 4172 wrote to memory of 1016 4172 111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe"C:\Users\Admin\AppData\Local\Temp\111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\VfjNv.exe"C:\Users\Admin\AppData\Local\Temp\VfjNv.exe"2⤵
- Executes dropped EXE
PID:3512
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe"2⤵PID:4652
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe"2⤵PID:4568
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c.exe"2⤵PID:1016
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\VfjNv.exe
- Size 52KB
- SHA256 fa8ea99095527fd41360592e271425182f40d49ffb9c82a3214aa963a7cc7f80
- MD5 4d306ed01994edf577b98fd59bf269c0
- SHA1 8f20d9835cadbc5a5c62b39f487ce2027dd2bf74
- SHA512 572c0a1cb38bb639dc29b273a6e16ba8252cf65774cfad5abd2d3c9460982a4ba94e42c865a196d1300fbd905db1ccc7614acdbebd7297f8b90b303e7341c9cf
- SSDEEP 1536:o+3Le8Ijge2LKEivuGWh3I5iLMfOuvHW:o+be8IjfNWh45iLMWuv2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\VfjNv.exe
- Size 52KB
- SHA256 fa8ea99095527fd41360592e271425182f40d49ffb9c82a3214aa963a7cc7f80
- MD5 4d306ed01994edf577b98fd59bf269c0
- SHA1 8f20d9835cadbc5a5c62b39f487ce2027dd2bf74
- SHA512 572c0a1cb38bb639dc29b273a6e16ba8252cf65774cfad5abd2d3c9460982a4ba94e42c865a196d1300fbd905db1ccc7614acdbebd7297f8b90b303e7341c9cf
- SSDEEP 1536:o+3Le8Ijge2LKEivuGWh3I5iLMfOuvHW:o+be8IjfNWh45iLMWuv2
- MD5 SHA1 SHA512 SSDEEP