Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 17:33

General

  • Target

    a352d00e0322a0e397f167c1164f7667c672935ba14d29c4f4b60f26d0a88f5d.exe

  • Size

    557KB

  • MD5

    11db2be72948149d039223e80f20c7bb

  • SHA1

    f3c8ad546a0830a6d5eae197ef812479b1520696

  • SHA256

    a352d00e0322a0e397f167c1164f7667c672935ba14d29c4f4b60f26d0a88f5d

  • SHA512

    38457af6ec05d23d5851ec2f7d7f0e281fd9634df2d44a50db1a75c73c4e8c42bacfd7e77445f83a981e479dbb1cd27250f450900d05bef37f701f590c7bc91a

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • ParallaxRat payload 6 IoCs

    Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a352d00e0322a0e397f167c1164f7667c672935ba14d29c4f4b60f26d0a88f5d.exe
    "C:\Users\Admin\AppData\Local\Temp\a352d00e0322a0e397f167c1164f7667c672935ba14d29c4f4b60f26d0a88f5d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Roaming\System32\csrss.exe.exe
      "C:\Users\Admin\AppData\Roaming\System32\csrss.exe.exe"
      2⤵
      • Adds Run key to start application
      PID:4492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2004-130-0x0000000002540000-0x00000000028D0000-memory.dmp

    Filesize

    3.6MB

  • memory/2004-131-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/2004-133-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/2004-135-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4492-136-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4492-138-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4492-139-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB