Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 05:41
Static task
static1
Behavioral task
behavioral1
Sample
c8808d17e4ce35534a702f4b318684ef.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c8808d17e4ce35534a702f4b318684ef.exe
-
Size
6.5MB
-
MD5
c8808d17e4ce35534a702f4b318684ef
-
SHA1
3739e8d38d5598a0ac67bc06cbef408ba6e3aa8f
-
SHA256
d8eb5792d969c21c364da69eca1322ab5f63e0a39b0e542bad4ee95be873c296
-
SHA512
db966f831ea28ce8110e5ac9df0ebfcc5f3ba30500cd87e404b69929821174fc9431e48b3838b893a9da39b02d9ce1b7396d66a1fcec80ec8451c6e4eceefeb1
-
SSDEEP
98304:OO5VI/yA/FFrWw//NtM/SmfGnp3b0o5O:/I/D/M/SmenP5O
Malware Config
Signatures
-
ParallaxRat payload 19 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/2192-7-0x00000000043F0000-0x0000000004423000-memory.dmp parallax_rat behavioral1/memory/2832-31-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-30-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-29-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-28-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-27-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-26-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-25-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-24-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-23-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-22-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-21-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-20-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-19-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-18-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-17-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-16-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-15-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2832-32-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\srs.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2088 c8808d17e4ce35534a702f4b318684ef.exe 2192 notepad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2192 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2088 c8808d17e4ce35534a702f4b318684ef.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2088 wrote to memory of 2192 2088 c8808d17e4ce35534a702f4b318684ef.exe 18 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29 PID 2192 wrote to memory of 2832 2192 notepad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8808d17e4ce35534a702f4b318684ef.exe"C:\Users\Admin\AppData\Local\Temp\c8808d17e4ce35534a702f4b318684ef.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Drops file in Windows directory
PID:2832
-
-