Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-02-2023 05:29
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
3.9MB
-
MD5
40256ea622aa1d0678f5bde48b9aa0fb
-
SHA1
ba9dc2820ff412f06ca986dd03af1880d5a60f41
-
SHA256
c3a3c6015ffc1bc98b5a21f89e78049900e5796e67e098bead011a20a99e7b0d
-
SHA512
04f9be55aeb88ff4f11b786f10e1bbcfa5cc1cf0b54f56d2d68fe067b0ada592f6aac93148cfbfe23916bbbe581669befebc4e95630f8c3e76303bc8e69ff450
-
SSDEEP
6144:DYh6ApoWrujS9yeoh6VVK7xvYTMxgUHgufnKiXybpsb:0h6ApVruja5oh2K755KUH5nNXylS
Malware Config
Signatures
-
ParallaxRat payload 9 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/2020-58-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-59-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-60-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-61-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-62-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-63-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-64-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-65-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/2020-68-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milk.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe 1204 tmp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1216 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 2020 1204 tmp.exe 29 PID 1204 wrote to memory of 1216 1204 tmp.exe 16
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵PID:2020
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:2024