parallax | cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f

General

Target

0ed2607808cbbef703ef49308748a888.exe
Size

3.6MB
MD5

0ed2607808cbbef703ef49308748a888
SHA1

e87b715c41f89066990bd04686abc57d65330f4b
SHA256

cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f
SHA512

7b940eb029f83041466ca890f39c16aef7c0dc3feec8bc006d839d6fc56e82f9925233a61909e14fb75ed398bb6fa13c0e9c7f2a102e3c033d7a679225a6dfb8
SSDEEP

49152:ALOYEQ7B+hS3oSbQzLlpkz1oGVpOtGQHZaDr:XYp+hhpeZpOtBHZg

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 19 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/1388-5-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-9-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-12-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-22-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-25-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-24-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-23-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-20-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-21-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-19-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-18-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-17-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-16-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-15-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-14-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-13-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-11-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-10-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/1388-34-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe
1536	0ed2607808cbbef703ef49308748a888.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1388	1536	0ed2607808cbbef703ef49308748a888.exe	28
PID 1536 wrote to memory of 1264	1536	0ed2607808cbbef703ef49308748a888.exe	16

C:\Users\Admin\AppData\Local\Temp\0ed2607808cbbef703ef49308748a888.exe
"C:\Users\Admin\AppData\Local\Temp\0ed2607808cbbef703ef49308748a888.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\notepad.exe
  "C:\Users\Admin\AppData\Local\Temp\0ed2607808cbbef703ef49308748a888.exe"
  2⤵
  PID:1388

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-31-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/1388-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-34-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-7-0x00000000775CF000-0x00000000775D0000-memory.dmp

Filesize
4KB

Download
memory/1388-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-8-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1388-4-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1388-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-25-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1388-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1536-2-0x00000000775CF000-0x00000000775D0000-memory.dmp

Filesize
4KB

Download
memory/1536-3-0x0000000002F20000-0x00000000030A0000-memory.dmp

Filesize
1.5MB

Download
memory/1536-33-0x0000000002130000-0x00000000021AB000-memory.dmp

Filesize
492KB

Download
memory/1536-32-0x0000000000400000-0x00000000007AB000-memory.dmp

Filesize
3.7MB

Download
memory/1536-1-0x0000000002130000-0x00000000021AB000-memory.dmp

Filesize
492KB

Download
memory/1536-28-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1536-27-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1536-26-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1536-0-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing