Analysis

  • max time kernel
    145s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 23:37

General

  • Target

    43b3cb0d8ead9a35e8bcda2048c3312f.exe

  • Size

    201KB

  • MD5

    43b3cb0d8ead9a35e8bcda2048c3312f

  • SHA1

    ba6b0d323f7a84367318bee772fe5cef0aff8c4c

  • SHA256

    212289b78e550d8af514e2efe785521d8c6e439d46789993711bdfe5b0bb2e6e

  • SHA512

    8d976541f6795db207b4bf56fe6298126017322d6498fb7fd7f1b34e91068784d81e43efc7df131ece0b03476479afb7c91338396002edec4452a39b00e689a2

  • SSDEEP

    6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFb:HqEjk7l7Fb

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe
    "C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe
      "C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\EJXGG.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f
          4⤵
          • Adds Run key to start application
          PID:2612
      • C:\Users\Admin\AppData\Roaming\Security\security.exe
        "C:\Users\Admin\AppData\Roaming\Security\security.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2596
  • C:\Users\Admin\AppData\Roaming\Security\security.exe
    "C:\Users\Admin\AppData\Roaming\Security\security.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2744
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1216-393-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1216-902-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1216-398-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/2040-10-0x0000000000290000-0x0000000000291000-memory.dmp

      Filesize

      4KB

    • memory/2040-2-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2040-304-0x00000000005E0000-0x00000000005E1000-memory.dmp

      Filesize

      4KB

    • memory/2040-122-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/2040-123-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/2040-20-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/2040-4-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2040-303-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/2040-16-0x00000000002B0000-0x00000000002B1000-memory.dmp

      Filesize

      4KB

    • memory/2596-591-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/2596-594-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2596-727-0x0000000002610000-0x0000000002611000-memory.dmp

      Filesize

      4KB

    • memory/2596-589-0x0000000000300000-0x0000000000301000-memory.dmp

      Filesize

      4KB

    • memory/2744-905-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB