Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 05:41
Static task
static1
Behavioral task
behavioral1
Sample
c8808d17e4ce35534a702f4b318684ef.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c8808d17e4ce35534a702f4b318684ef.exe
-
Size
6.5MB
-
MD5
c8808d17e4ce35534a702f4b318684ef
-
SHA1
3739e8d38d5598a0ac67bc06cbef408ba6e3aa8f
-
SHA256
d8eb5792d969c21c364da69eca1322ab5f63e0a39b0e542bad4ee95be873c296
-
SHA512
db966f831ea28ce8110e5ac9df0ebfcc5f3ba30500cd87e404b69929821174fc9431e48b3838b893a9da39b02d9ce1b7396d66a1fcec80ec8451c6e4eceefeb1
-
SSDEEP
98304:OO5VI/yA/FFrWw//NtM/SmfGnp3b0o5O:/I/D/M/SmenP5O
Malware Config
Signatures
-
ParallaxRat payload 19 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/388-11-0x0000000004610000-0x0000000004643000-memory.dmp parallax_rat behavioral2/memory/3752-27-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-29-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-28-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-30-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-31-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-32-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-33-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-34-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-35-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-37-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-36-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-38-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-39-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-40-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-41-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-42-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-43-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral2/memory/3752-44-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\srs.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4920 c8808d17e4ce35534a702f4b318684ef.exe 388 notepad.exe 388 notepad.exe 388 notepad.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 388 notepad.exe 388 notepad.exe 388 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4920 c8808d17e4ce35534a702f4b318684ef.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93 PID 4920 wrote to memory of 388 4920 c8808d17e4ce35534a702f4b318684ef.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8808d17e4ce35534a702f4b318684ef.exe"C:\Users\Admin\AppData\Local\Temp\c8808d17e4ce35534a702f4b318684ef.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:5116
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Drops file in Windows directory
PID:3752
-
-