parallax | 0cb06c655b686f300f944519e89bee199089d22598bfa83ac969b88a6b2cb15e

General

Target

83c5bbe9284eead577d370cfe429685e.exe
Size

3.6MB
MD5

83c5bbe9284eead577d370cfe429685e
SHA1

c33c6f6a0f65673439fe1f18e110e46564cf7586
SHA256

0cb06c655b686f300f944519e89bee199089d22598bfa83ac969b88a6b2cb15e
SHA512

943c68646bbbb1e1d2c6d4387bf024ffeb03fc2f24dd9bf07237446a3dc6466fb257bb6cb59d52aaefce7a26bd2a88d1eaaa2755c040d545943bc4541402d22f
SSDEEP

49152:ZLOYEQ7B+hS3oSbQzmlpkz1oGVpOtGQHZY1:4Yp+hqpeZpOtBHZY1

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 19 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/2484-5-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-24-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-26-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-25-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-23-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-22-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-21-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-20-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-19-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-18-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-17-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-16-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-15-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-14-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-13-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-12-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-11-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-10-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/2484-27-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Blocklisted process makes network request 8 IoCs

flow	pid	Process
6	2484	rundll32.exe
6	2484	rundll32.exe
36	2484	rundll32.exe
36	2484	rundll32.exe
6	2484	rundll32.exe
6	2484	rundll32.exe
36	2484	rundll32.exe
36	2484	rundll32.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe
8	83c5bbe9284eead577d370cfe429685e.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36
PID 8 wrote to memory of 2484	8	83c5bbe9284eead577d370cfe429685e.exe	36

C:\Users\Admin\AppData\Local\Temp\83c5bbe9284eead577d370cfe429685e.exe
"C:\Users\Admin\AppData\Local\Temp\83c5bbe9284eead577d370cfe429685e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Users\Admin\AppData\Local\Temp\83c5bbe9284eead577d370cfe429685e.exe"
  2⤵
  - Blocklisted process makes network request
  PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-8-0x00000000025B0000-0x000000000262B000-memory.dmp

Filesize
492KB

Download
memory/8-1-0x00000000025B0000-0x000000000262B000-memory.dmp

Filesize
492KB

Download
memory/8-2-0x0000000077A42000-0x0000000077A43000-memory.dmp

Filesize
4KB

Download
memory/8-0-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/8-4-0x0000000000400000-0x00000000007AA000-memory.dmp

Filesize
3.7MB

Download
memory/8-3-0x0000000002740000-0x00000000028E3000-memory.dmp

Filesize
1.6MB

Download
memory/2484-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-26-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-25-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-9-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/2484-7-0x0000000077A42000-0x0000000077A43000-memory.dmp

Filesize
4KB

Download
memory/2484-27-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing