parallax | 933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe
Size

10KB
MD5

f69059ad815f1dd2c628c50fc8e4feb2
SHA1

30dde7e504c65b235a27c0d6aa21d5bba11704ae
SHA256

933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9
SHA512

caff72578b1df2818510c9707706551e56117f4d2975017104ccbc584ef30ab85c8d21b16bc910ddcf41ba108beeafa7b21656bc553cf449228a83686c34762a
SSDEEP

192:1Lam6QndF6qz3X1ucPg31surVP0VMnlYJLUDLT4t9W96bEbF5N3p:1LOQ6qz0zj0fwDLT4tUQbEbF33p

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Executes dropped EXE 1 IoCs

pid	Process
1108	winsvchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe
1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe
1108	winsvchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe
Token: SeDebugPrivilege	1108	winsvchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1108	1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe	26
PID 1928 wrote to memory of 1108	1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe	26
PID 1928 wrote to memory of 1108	1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe	26
PID 1928 wrote to memory of 1108	1928	933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe	26

C:\Users\Admin\AppData\Local\Temp\933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe
"C:\Users\Admin\AppData\Local\Temp\933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Roaming\Security\winsvchost.exe
  C:\Users\Admin\AppData\Roaming\Security\winsvchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Security\winsvchost.exe

Filesize
10KB

MD5
f69059ad815f1dd2c628c50fc8e4feb2

SHA1
30dde7e504c65b235a27c0d6aa21d5bba11704ae

SHA256
933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9

SHA512
caff72578b1df2818510c9707706551e56117f4d2975017104ccbc584ef30ab85c8d21b16bc910ddcf41ba108beeafa7b21656bc553cf449228a83686c34762a

Download Submit
C:\Users\Admin\AppData\Roaming\Security\winsvchost.exe

Filesize
10KB

MD5
f69059ad815f1dd2c628c50fc8e4feb2

SHA1
30dde7e504c65b235a27c0d6aa21d5bba11704ae

SHA256
933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9

SHA512
caff72578b1df2818510c9707706551e56117f4d2975017104ccbc584ef30ab85c8d21b16bc910ddcf41ba108beeafa7b21656bc553cf449228a83686c34762a

Download Submit
\Users\Admin\AppData\Roaming\Security\winsvchost.exe

Filesize
10KB

MD5
f69059ad815f1dd2c628c50fc8e4feb2

SHA1
30dde7e504c65b235a27c0d6aa21d5bba11704ae

SHA256
933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9

SHA512
caff72578b1df2818510c9707706551e56117f4d2975017104ccbc584ef30ab85c8d21b16bc910ddcf41ba108beeafa7b21656bc553cf449228a83686c34762a

Download Submit
\Users\Admin\AppData\Roaming\Security\winsvchost.exe

Filesize
10KB

MD5
f69059ad815f1dd2c628c50fc8e4feb2

SHA1
30dde7e504c65b235a27c0d6aa21d5bba11704ae

SHA256
933802260041aff666b21972e6bb407bd6ca17a9200ec78d0fc9ec6b53d05db9

SHA512
caff72578b1df2818510c9707706551e56117f4d2975017104ccbc584ef30ab85c8d21b16bc910ddcf41ba108beeafa7b21656bc553cf449228a83686c34762a

Download Submit
memory/1108-64-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1108-65-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1928-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1928-55-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1928-56-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1928-63-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download