Analysis

  • max time kernel
    150s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    21-10-2022 03:46

General

  • Target

    533cb956f9fef6c4f31e98aff2f29e124bf87c14db4e76ae7bb3828a618bbee6.exe

  • Size

    201KB

  • MD5

    579571d4c079fa8ae6a167eeb42eda30

  • SHA1

    ce49d258e24df707fb9f0b9ccaff8d0de3fde193

  • SHA256

    533cb956f9fef6c4f31e98aff2f29e124bf87c14db4e76ae7bb3828a618bbee6

  • SHA512

    c19db5a08613ed7e4b360d32f209c70cfa33bb7ba0c0e816bc854671998fa4e76f9e7bb081d6b7d3684deac980d3747e2fa58c8e958db85bdc0ced4566b90337

  • SSDEEP

    6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFG:HqEjk7l7FG

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\533cb956f9fef6c4f31e98aff2f29e124bf87c14db4e76ae7bb3828a618bbee6.exe
    "C:\Users\Admin\AppData\Local\Temp\533cb956f9fef6c4f31e98aff2f29e124bf87c14db4e76ae7bb3828a618bbee6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\533cb956f9fef6c4f31e98aff2f29e124bf87c14db4e76ae7bb3828a618bbee6.exe
      "C:\Users\Admin\AppData\Local\Temp\533cb956f9fef6c4f31e98aff2f29e124bf87c14db4e76ae7bb3828a618bbee6.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AWVMC.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f
          4⤵
          • Adds Run key to start application
          PID:560
      • C:\Users\Admin\AppData\Roaming\Security\security.exe
        "C:\Users\Admin\AppData\Roaming\Security\security.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Users\Admin\AppData\Roaming\Security\security.exe
          "C:\Users\Admin\AppData\Roaming\Security\security.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1440
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:1496

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AWVMC.bat

      Filesize

      147B

      MD5

      6f473a1ba53e043362047f72e20b34f4

      SHA1

      e8f121a589e1207ed950453376ee1d21b1223835

      SHA256

      5fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b

      SHA512

      b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818

    • C:\Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • C:\Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • C:\Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      919aa4c69ed5897ce9a5da3a2a6bcb91

      SHA1

      baa1159451c70b8b293b1ef6834d5d5abaed6330

      SHA256

      d3245c43bcf2831e084cc4cd697d03d6ca16586cb794e89ebbfa2e7bc33bc974

      SHA512

      b686aca73700b5b6b10826c815fb05173b584686dc737336bb448090c9a22f88ae13305f25f955f09361177ef1c4ca23b3a4073396f9bd785f4093b1d9e6e17d

    • memory/1036-66-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-65-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-59-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-70-0x0000000075601000-0x0000000075603000-memory.dmp

      Filesize

      8KB

    • memory/1036-69-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-62-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-58-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-61-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1036-108-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1348-56-0x000000000056C000-0x000000000057E000-memory.dmp

      Filesize

      72KB

    • memory/1440-110-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1440-112-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1496-98-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1496-95-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1496-101-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1496-102-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1496-106-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1496-109-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

      Filesize

      8KB

    • memory/1496-93-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1756-83-0x000000000051F000-0x0000000000531000-memory.dmp

      Filesize

      72KB