Analysis
-
max time kernel
175s -
max time network
180s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
-
submitted
11-10-2023 07:48
General
-
Target
c1a82483c5c15c1a42d67f11d996bb6281d72ada03c2f29324bfdc6be8a8eb80.exe
-
Size
2.3MB
-
MD5
fa47ee4bab2af505a4c2fd14b9068e31
-
SHA1
6e397ae0e990fb0f04473628cfe9da0acf68a9ca
-
SHA256
c1a82483c5c15c1a42d67f11d996bb6281d72ada03c2f29324bfdc6be8a8eb80
-
SHA512
f4f8ab16e6531dbf6788eb9fb03748d546742a1f21e3b80f5a05def733dc4a0c21c0d55a02e9deb573b23b3d98856191de1591221493b1454602b05468c179f4
-
SSDEEP
49152:hq3QscuJsVPCYc80pixEXY2QpvH8ntf9Gion08ZfRqt:h0nJsVPBcexz2QpvHql9GiolRa
Malware Config
Signatures
-
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
-
ParallaxRat payload 18 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1a82483c5c15c1a42d67f11d996bb6281d72ada03c2f29324bfdc6be8a8eb80.exe"C:\Users\Admin\AppData\Local\Temp\c1a82483c5c15c1a42d67f11d996bb6281d72ada03c2f29324bfdc6be8a8eb80.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
512KB
-
Filesize
832KB
-
Filesize
176KB