parallax | fbf003e40568ccf053e2abd44541c8a2da441970e6e59231612de39ee0d0273e

General

Target

index.exe
Size

1.6MB
MD5

18462ea23f4eb50b95c5c3c30674f26c
SHA1

052ff2ecd199f4fae7965edc8a5ae0fe45583a10
SHA256

fbf003e40568ccf053e2abd44541c8a2da441970e6e59231612de39ee0d0273e
SHA512

9c4f21d07afc1f4a6b7064765ee21401d914699ea3db008cd3337c86c206e110638366273f285e09823717151c0e5af394fb813e5216c16d322f3f7fdf8f2a05
SSDEEP

12288:QNVVsrGvaRlb2nZS1dUpSp3fHdwBhT3eTcS5x:8VTPnZSXUpShfWBhT3ewS5

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 18 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/852-141-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-146-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-148-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-149-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-147-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-145-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-150-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-144-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-143-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-142-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-153-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-155-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-152-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-151-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-154-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-156-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-157-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat
behavioral2/memory/852-163-0x0000000003770000-0x000000000379C000-memory.dmp	parallax_rat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reter.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reter.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe
852	index.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3184	Explorer.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3184	852	index.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3184
- C:\Users\Admin\AppData\Local\Temp\index.exe
  "C:\Users\Admin\AppData\Local\Temp\index.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:852

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-143-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-157-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-133-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/852-140-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/852-142-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-137-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/852-141-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-146-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-148-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-149-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-147-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-153-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-150-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-144-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-139-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/852-163-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-145-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-155-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-152-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-151-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-154-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-156-0x0000000003770000-0x000000000379C000-memory.dmp

Filesize
176KB

Download
memory/852-134-0x0000000077082000-0x0000000077083000-memory.dmp

Filesize
4KB

Download
memory/852-158-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/852-159-0x0000000002DA0000-0x0000000002E90000-memory.dmp

Filesize
960KB

Download
memory/852-160-0x00000000037C0000-0x000000000387E000-memory.dmp

Filesize
760KB

Download
memory/852-161-0x0000000003880000-0x0000000003B49000-memory.dmp

Filesize
2.8MB

Download
memory/852-162-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/3184-138-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing