parallax | febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa

Analysis

max time kernel
150s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
Size

201KB
MD5

0329549af7ca2ed4c79d2bcf8b724e61
SHA1

141b9750d8522b14312d2bc0b4259ebbf603c335
SHA256

febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa
SHA512

d4e1907dd1f2ab2905a64e6b8d85fc259897dd5ea691eaa3c4488b10045d8e0cf877ddc10da29d9a0b372b93c30f49c736e81270a706f062a96cb10263802512
SSDEEP

6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFp:HqEjk7l7Fp

Score

10^/10

parallax persistence rat upx

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Executes dropped EXE 2 IoCs

pid	Process
1172	security.exe
588	security.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1336-59-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1336-61-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1336-62-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1336-65-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1336-66-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1336-69-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1336-108-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/588-110-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/588-112-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1172 set thread context of 588	1172	security.exe	31
PID 1172 set thread context of 1184	1172	security.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe
Token: SeDebugPrivilege	588	security.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
1172	security.exe
588	security.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1388 wrote to memory of 1336	1388	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	26
PID 1336 wrote to memory of 964	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	27
PID 1336 wrote to memory of 964	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	27
PID 1336 wrote to memory of 964	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	27
PID 1336 wrote to memory of 964	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	27
PID 964 wrote to memory of 952	964	cmd.exe	29
PID 964 wrote to memory of 952	964	cmd.exe	29
PID 964 wrote to memory of 952	964	cmd.exe	29
PID 964 wrote to memory of 952	964	cmd.exe	29
PID 1336 wrote to memory of 1172	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	30
PID 1336 wrote to memory of 1172	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	30
PID 1336 wrote to memory of 1172	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	30
PID 1336 wrote to memory of 1172	1336	febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe	30
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 588	1172	security.exe	31
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32
PID 1172 wrote to memory of 1184	1172	security.exe	32

C:\Users\Admin\AppData\Local\Temp\febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
"C:\Users\Admin\AppData\Local\Temp\febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe
  "C:\Users\Admin\AppData\Local\Temp\febace4191306b2b6cae04a1fd81b4fdcb9c8f454780875c4dcf83472cb092aa.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\MQVCD.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f
      4⤵
      Adds Run key to start application
      PID:952
- - C:\Users\Admin\AppData\Roaming\Security\security.exe
    "C:\Users\Admin\AppData\Roaming\Security\security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Users\Admin\AppData\Roaming\Security\security.exe
      "C:\Users\Admin\AppData\Roaming\Security\security.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:588
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MQVCD.bat

Filesize
147B

MD5
6f473a1ba53e043362047f72e20b34f4

SHA1
e8f121a589e1207ed950453376ee1d21b1223835

SHA256
5fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b

SHA512
b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818

Download Submit
C:\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
C:\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
C:\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
955ebb23ad0d036f4b713cd41c869e8f

SHA1
1a887f35e8dc9a3d349a07df5c05d63ba67bd64e

SHA256
48da487ca2f44bf5914831bc26c6c0adebda0213260121854730fc56fb2947ff

SHA512
032b56e26f84412c8b0e036cb129429a20ee8ad3ca762f2bf9c48a99f50ef5a48c5b12fd5cf839f8480d8941ef3a6c75f6a6d2098970d707ff7d784a3c569a33

Download Submit
memory/588-112-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/588-110-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1172-83-0x000000000058F000-0x00000000005A1000-memory.dmp

Filesize
72KB

Download
memory/1184-103-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1184-109-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1184-106-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1184-104-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1184-99-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1184-93-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1184-95-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1336-58-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-59-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-65-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-62-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-61-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-108-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-69-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1336-70-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x00000000005FC000-0x000000000060E000-memory.dmp

Filesize
72KB

Download