parallax | 8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4

General

Target

8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe
Size

1.4MB
MD5

c9ddc48f08e3678e2a4e65d4951dc261
SHA1

7b2e70ecdf86e9461f0cb4e6aeb37cae893bcfa5
SHA256

8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4
SHA512

cfa8b15fa6df43f47a63085382f18c8f2a9f170781c54c52f4ca584924c601f7664ea113ee2b103fd3e288179cc709b0fee1830c9cea868400c28c32fbb43825
SSDEEP

24576:jxdW2AUOoj6Rc4FoweN2vtUm5a4j06/b9y8lDbe+Eltpe3f:dZA4BEoZsh5ayFy8lU6f

Score

10^/10

parallax persistence rat upx

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000139eb-75.dat	acprotect
behavioral1/files/0x0008000000013a17-78.dat	acprotect
behavioral1/files/0x0008000000013a17-77.dat	acprotect
behavioral1/files/0x00090000000139eb-76.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
588	System32.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014145-70.dat	upx
behavioral1/files/0x0006000000014145-71.dat	upx
behavioral1/files/0x0006000000014145-73.dat	upx
behavioral1/files/0x00090000000139eb-75.dat	upx
behavioral1/files/0x0008000000013a17-78.dat	upx
behavioral1/files/0x0008000000013a17-77.dat	upx
behavioral1/files/0x00090000000139eb-76.dat	upx
behavioral1/memory/588-80-0x0000000013900000-0x000000001394B000-memory.dmp	upx
behavioral1/memory/588-81-0x0000000011000000-0x00000000110F4000-memory.dmp	upx
behavioral1/memory/588-82-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/588-83-0x0000000011000000-0x00000000110F4000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1236	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe
1236	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe
588	System32.exe
588	System32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe\""	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1440 wrote to memory of 1236	1440	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	28
PID 1236 wrote to memory of 588	1236	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	29
PID 1236 wrote to memory of 588	1236	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	29
PID 1236 wrote to memory of 588	1236	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	29
PID 1236 wrote to memory of 588	1236	8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe	29

C:\Users\Admin\AppData\Local\Temp\8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe
"C:\Users\Admin\AppData\Local\Temp\8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe
  "C:\Users\Admin\AppData\Local\Temp\8219311bc99c105c1edc420fbcd2067ea839b499248e1c45b31596161a76c4c4.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Roaming\Security\System32.exe
    C:\Users\Admin\AppData\Roaming\Security\System32.exe -o http://H4x0r_djred2:[email protected]:8344
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Security\System32.exe

Filesize
14KB

MD5
9922477bc8d154d7c1d9528e03325d0b

SHA1
ff4401fed76657a2325485eabccfbbae9156cb7f

SHA256
a0b3de75033b8ede8661b316a0baf6ab5899afb9515a9d525e914be35c440d91

SHA512
58266baa6bb223769f88eff1709abb0fef5911bfd6a58d09cac56952a5829a763616682e674f7c12a15d692f794ce89eb0e5174a33d1a9e5d4b6cf41a83098a5

Download Submit
C:\Users\Admin\AppData\Roaming\Security\miner.dll

Filesize
74KB

MD5
93f6d0122c2b13a55ec467549429b5c8

SHA1
3f1e2101831d8b812c92bb03b7de0a2b47314c21

SHA256
a11b09086205010e41ee0e938539b7fdbc132f73e85ed54df1016dee4f8793a0

SHA512
aeef696afa62cf4c61372868f31f0706110de6f57faf5fa8990aa26b9f236405f7aee22511425009280ca861afeeda84a90a3c180a9e3eea3309a1830badd055

Download Submit
C:\Users\Admin\AppData\Roaming\Security\usft_ext.dll

Filesize
328KB

MD5
5cce96ba11c1492b7ce00030d98021de

SHA1
94054638dea3711cf28de3ec9d9b8fe4a54aef80

SHA256
4453e1939e32ea39c70b7b61265fa990dfc27e054838a0a559d4c86249af11b9

SHA512
35dadeea5171e62b5b7cb6b0bff9b83ebb830f5d9453444513295b4e56f3d3e25abb15ef45015b000d0477754268e45e56230d15f417f12fc0f89002f3cb4652

Download Submit
\Users\Admin\AppData\Roaming\Security\System32.exe

Filesize
14KB

MD5
9922477bc8d154d7c1d9528e03325d0b

SHA1
ff4401fed76657a2325485eabccfbbae9156cb7f

SHA256
a0b3de75033b8ede8661b316a0baf6ab5899afb9515a9d525e914be35c440d91

SHA512
58266baa6bb223769f88eff1709abb0fef5911bfd6a58d09cac56952a5829a763616682e674f7c12a15d692f794ce89eb0e5174a33d1a9e5d4b6cf41a83098a5

Download Submit
\Users\Admin\AppData\Roaming\Security\System32.exe

Filesize
14KB

MD5
9922477bc8d154d7c1d9528e03325d0b

SHA1
ff4401fed76657a2325485eabccfbbae9156cb7f

SHA256
a0b3de75033b8ede8661b316a0baf6ab5899afb9515a9d525e914be35c440d91

SHA512
58266baa6bb223769f88eff1709abb0fef5911bfd6a58d09cac56952a5829a763616682e674f7c12a15d692f794ce89eb0e5174a33d1a9e5d4b6cf41a83098a5

Download Submit
\Users\Admin\AppData\Roaming\Security\miner.dll

Filesize
74KB

MD5
93f6d0122c2b13a55ec467549429b5c8

SHA1
3f1e2101831d8b812c92bb03b7de0a2b47314c21

SHA256
a11b09086205010e41ee0e938539b7fdbc132f73e85ed54df1016dee4f8793a0

SHA512
aeef696afa62cf4c61372868f31f0706110de6f57faf5fa8990aa26b9f236405f7aee22511425009280ca861afeeda84a90a3c180a9e3eea3309a1830badd055

Download Submit
\Users\Admin\AppData\Roaming\Security\usft_ext.dll

Filesize
328KB

MD5
5cce96ba11c1492b7ce00030d98021de

SHA1
94054638dea3711cf28de3ec9d9b8fe4a54aef80

SHA256
4453e1939e32ea39c70b7b61265fa990dfc27e054838a0a559d4c86249af11b9

SHA512
35dadeea5171e62b5b7cb6b0bff9b83ebb830f5d9453444513295b4e56f3d3e25abb15ef45015b000d0477754268e45e56230d15f417f12fc0f89002f3cb4652

Download Submit
memory/588-83-0x0000000011000000-0x00000000110F4000-memory.dmp

Filesize
976KB

Download
memory/588-82-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/588-81-0x0000000011000000-0x00000000110F4000-memory.dmp

Filesize
976KB

Download
memory/588-80-0x0000000013900000-0x000000001394B000-memory.dmp

Filesize
300KB

Download
memory/1236-74-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-61-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-60-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-63-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-59-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-58-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-56-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-55-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-69-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-67-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1236-65-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1440-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing