Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-02-2023 22:33

General

  • Target

    GoDaddyChanges2023.exe

  • Size

    19.0MB

  • MD5

    2b24e35a767cdcb73808fb2ef3c6876a

  • SHA1

    031cd6cb0a890968c168a290e109e1553b95bdf5

  • SHA256

    69a145831b695d9e8d74ff634b8c0412ac93488d7bff1fc63d702ebf48333a5a

  • SHA512

    aa7317c3701777d02854129f6b2308d0cba1657503f491de156f8b75fa80f5086b86fa7b4109df652722eab65c1f4bafab15973cfb02763364bd914240ee3a3c

  • SSDEEP

    393216:mvFeJuTCvsmyI8BcQNOXnjmkehKUz+mXDHV5ZK0Gg:kIY5ZK0G

Score
10/10

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • ParallaxRat payload 4 IoCs

    Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\GoDaddyChanges2023.exe
      "C:\Users\Admin\AppData\Local\Temp\GoDaddyChanges2023.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/424-133-0x0000000000400000-0x0000000001846000-memory.dmp

    Filesize

    20.3MB

  • memory/424-134-0x0000000001E70000-0x0000000001EEB000-memory.dmp

    Filesize

    492KB

  • memory/424-181-0x0000000000400000-0x0000000001846000-memory.dmp

    Filesize

    20.3MB

  • memory/424-136-0x0000000003770000-0x0000000003913000-memory.dmp

    Filesize

    1.6MB

  • memory/424-138-0x0000000001B30000-0x0000000001B31000-memory.dmp

    Filesize

    4KB

  • memory/424-137-0x0000000001B50000-0x0000000001B51000-memory.dmp

    Filesize

    4KB

  • memory/424-139-0x0000000001B60000-0x0000000001B61000-memory.dmp

    Filesize

    4KB

  • memory/424-140-0x0000000000400000-0x0000000001846000-memory.dmp

    Filesize

    20.3MB

  • memory/424-141-0x0000000003A20000-0x0000000003B10000-memory.dmp

    Filesize

    960KB

  • memory/424-142-0x0000000001EF0000-0x0000000001FAE000-memory.dmp

    Filesize

    760KB

  • memory/424-143-0x0000000003D60000-0x0000000004029000-memory.dmp

    Filesize

    2.8MB

  • memory/424-144-0x0000000001E70000-0x0000000001EEB000-memory.dmp

    Filesize

    492KB

  • memory/424-177-0x0000000000400000-0x0000000001846000-memory.dmp

    Filesize

    20.3MB

  • memory/424-169-0x0000000000400000-0x0000000001846000-memory.dmp

    Filesize

    20.3MB

  • memory/1292-157-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-189-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-150-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-149-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-151-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-152-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-153-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-154-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-155-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-156-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-147-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-158-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-159-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-160-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-146-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-145-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-135-0x00000000014B0000-0x00000000014B1000-memory.dmp

    Filesize

    4KB

  • memory/1292-148-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-190-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-191-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-192-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-194-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-193-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-195-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-196-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-197-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-198-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-199-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-200-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-201-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-202-0x0000000008030000-0x0000000008040000-memory.dmp

    Filesize

    64KB

  • memory/1292-205-0x0000000007B80000-0x0000000007B82000-memory.dmp

    Filesize

    8KB

  • memory/1292-246-0x0000000002FA0000-0x0000000002FA2000-memory.dmp

    Filesize

    8KB

  • memory/1292-247-0x0000000002FB0000-0x0000000002FB7000-memory.dmp

    Filesize

    28KB