parallax | cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f

General

Target

0ed2607808cbbef703ef49308748a888.exe
Size

3.6MB
MD5

0ed2607808cbbef703ef49308748a888
SHA1

e87b715c41f89066990bd04686abc57d65330f4b
SHA256

cfe98c638ebfe783fea3dc9168d037fb8b7255ab368800cf97e6ed6f37736b7f
SHA512

7b940eb029f83041466ca890f39c16aef7c0dc3feec8bc006d839d6fc56e82f9925233a61909e14fb75ed398bb6fa13c0e9c7f2a102e3c033d7a679225a6dfb8
SSDEEP

49152:ALOYEQ7B+hS3oSbQzLlpkz1oGVpOtGQHZaDr:XYp+hhpeZpOtBHZg

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 19 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/4836-8-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-18-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-24-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-23-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-22-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-21-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-20-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-19-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-17-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-16-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-15-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-14-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-13-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-12-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-11-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-10-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-9-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-4-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/4836-32-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3388	4976	WerFault.exe	16

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe
4976	0ed2607808cbbef703ef49308748a888.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 4836	4976	0ed2607808cbbef703ef49308748a888.exe	30
PID 4976 wrote to memory of 3452	4976	0ed2607808cbbef703ef49308748a888.exe	47

C:\Users\Admin\AppData\Local\Temp\0ed2607808cbbef703ef49308748a888.exe
"C:\Users\Admin\AppData\Local\Temp\0ed2607808cbbef703ef49308748a888.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\notepad.exe
  "C:\Users\Admin\AppData\Local\Temp\0ed2607808cbbef703ef49308748a888.exe"
  2⤵
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 784
  2⤵
  - Program crash
  PID:3388

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4976 -ip 4976
1⤵
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4836-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-5-0x0000000077652000-0x0000000077653000-memory.dmp

Filesize
4KB

Download
memory/4836-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-7-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/4836-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4836-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4976-29-0x0000000002EE0000-0x0000000002F9E000-memory.dmp

Filesize
760KB

Download
memory/4976-2-0x0000000077652000-0x0000000077653000-memory.dmp

Filesize
4KB

Download
memory/4976-3-0x00000000028E0000-0x0000000002A83000-memory.dmp

Filesize
1.6MB

Download
memory/4976-27-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Filesize
4KB

Download
memory/4976-26-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4976-25-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/4976-31-0x0000000002860000-0x00000000028DB000-memory.dmp

Filesize
492KB

Download
memory/4976-30-0x0000000002FA0000-0x0000000003269000-memory.dmp

Filesize
2.8MB

Download
memory/4976-0-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/4976-28-0x0000000000400000-0x00000000007AB000-memory.dmp

Filesize
3.7MB

Download
memory/4976-1-0x0000000002860000-0x00000000028DB000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing