Analysis
-
max time kernel
58s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-03-2023 10:56
Static task
static1
Behavioral task
behavioral1
Sample
parallaxhuge.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
General
-
Target
parallaxhuge.exe
-
Size
3.9MB
-
MD5
40256ea622aa1d0678f5bde48b9aa0fb
-
SHA1
ba9dc2820ff412f06ca986dd03af1880d5a60f41
-
SHA256
c3a3c6015ffc1bc98b5a21f89e78049900e5796e67e098bead011a20a99e7b0d
-
SHA512
04f9be55aeb88ff4f11b786f10e1bbcfa5cc1cf0b54f56d2d68fe067b0ada592f6aac93148cfbfe23916bbbe581669befebc4e95630f8c3e76303bc8e69ff450
-
SSDEEP
6144:DYh6ApoWrujS9yeoh6VVK7xvYTMxgUHgufnKiXybpsb:0h6ApVruja5oh2K755KUH5nNXylS
Malware Config
Signatures
-
ParallaxRat payload 9 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1644-58-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-59-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-60-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-61-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-62-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-63-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-64-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-65-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat behavioral1/memory/1644-68-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milk.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe 1320 parallaxhuge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1644 1320 parallaxhuge.exe 29 PID 1320 wrote to memory of 1284 1320 parallaxhuge.exe 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\parallaxhuge.exe"C:\Users\Admin\AppData\Local\Temp\parallaxhuge.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\parallaxhuge.exe"3⤵PID:1644
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:1336