Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
25-02-2023 22:33
General
-
Target
GoDaddyChanges2023.exe
-
Size
19.0MB
-
MD5
2b24e35a767cdcb73808fb2ef3c6876a
-
SHA1
031cd6cb0a890968c168a290e109e1553b95bdf5
-
SHA256
69a145831b695d9e8d74ff634b8c0412ac93488d7bff1fc63d702ebf48333a5a
-
SHA512
aa7317c3701777d02854129f6b2308d0cba1657503f491de156f8b75fa80f5086b86fa7b4109df652722eab65c1f4bafab15973cfb02763364bd914240ee3a3c
-
SSDEEP
393216:mvFeJuTCvsmyI8BcQNOXnjmkehKUz+mXDHV5ZK0Gg:kIY5ZK0G
Score
10/10
Malware Config
Signatures
-
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
-
ParallaxRat payload 5 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\GoDaddyChanges2023.exe"C:\Users\Admin\AppData\Local\Temp\GoDaddyChanges2023.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
20.3MB
-
Filesize
20.3MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
20.3MB
-
Filesize
20.3MB
-
Filesize
20.3MB
-
Filesize
20.3MB
-
Filesize
4KB
-
Filesize
4KB