Analysis
-
max time kernel
130s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Important request info_patched.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Important request info_patched.exe
-
Size
5.0MB
-
MD5
6efac878a36d9182175a129fc7b162de
-
SHA1
92ad7e8537aef825a5ccccf537c67b07be2a81c5
-
SHA256
e6de9b0568ed00dfecffc9e1060c7e9985507796f9c9374d524462bc73f1e522
-
SHA512
1465a2427b8a40e38d6c8a5189e1a4904f0b9117af97802c8600c1750c3883c19c4fd3b7c4f71bd240345bcc868b5eef8c79a6612581539a476eb142ccb7228e
-
SSDEEP
98304:h0yp7P5XDK2M502KeN05l2q7RXHxQ1jfF:qypL5XCHWl2IB
Malware Config
Signatures
-
ParallaxRat payload 23 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/2040-3-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-5-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-7-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-9-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-16-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-21-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-23-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-24-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-25-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-26-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-27-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-28-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-29-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-30-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-31-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-32-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-33-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-34-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-35-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-36-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-37-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-38-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat behavioral1/memory/2040-39-0x0000000000400000-0x000000000042C000-memory.dmp parallax_rat -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe 2052 Important request info_patched.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28 PID 2052 wrote to memory of 2040 2052 Important request info_patched.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Important request info_patched.exe"C:\Users\Admin\AppData\Local\Temp\Important request info_patched.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\Important request info_patched.exe"2⤵PID:2040
-