hxxps://github[.]com/yuankong666/Ultimate-RAT-Collection/raw/main/ParallaxRat/Parallax%20v1[.]0[.]7[.]7z

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/yuankong666/Ultimate-RAT-Collection/raw/main/ParallaxRat/Parallax%20v1.0.7.7z

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
240	msedge.exe
240	msedge.exe
1064	identity_helper.exe
1064	identity_helper.exe
4516	msedge.exe
4516	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1460	240	msedge.exe	19
PID 240 wrote to memory of 1460	240	msedge.exe	19
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 1300	240	msedge.exe	76
PID 240 wrote to memory of 3188	240	msedge.exe	74
PID 240 wrote to memory of 3188	240	msedge.exe	74
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75
PID 240 wrote to memory of 3532	240	msedge.exe	75

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/yuankong666/Ultimate-RAT-Collection/raw/main/ParallaxRat/Parallax%20v1.0.7.7z
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa222446f8,0x7ffa22244708,0x7ffa22244718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,534031452425491418,1528315961829277980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
2c2e6472d05e3832905f0ad4a04d21c3

SHA1
007edbf35759af62a5b847ab09055e7d9b86ffcc

SHA256
283d954fa21caa1f3b4aba941b154fab3e626ff27e7b8029f5357872c48cbe03

SHA512
8c4ce1ea02da6ffb7e7041c50528da447d087d9ee3c9f4a8c525d2d856cf48e46f5dd9a1fedd23dd047634e719c8886457f7e7240aa3cc36f1a6216e4c00ee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3319ac066b235697677030404b2f051f

SHA1
2b934557d547e83985b1b40fd0502aebeb051ef9

SHA256
91d7b6779f684eca3e9d7564bfb710bbfd7f8252695bcf20b2bae22c3368ea1b

SHA512
e2261a5bebb865f6df1eeb2800805570e02279875b8acc0dccb696d66a39b31dd76cee624318ae400c348995b8d311bc0c0f45e0b5953d7ce3c01ed381c84aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d89bc559092ec4c78d8abf751b51c28

SHA1
34f70c4470acaa0f58b656bca7351500977023ce

SHA256
44f0cc6f9cb583853c774bd10863b868ac0e75cf4f33f97d8054f1f3dfb67e02

SHA512
74f071c28d8276966bc9d7be2f2e902dff94ac8ca954784fb68d216f318b6ebcd78ecf86585b8747d967b9519effec65d3b8f21c79f5c0974cb09380193b922e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b7f34886e5c09796309263f028c28be

SHA1
251cbc7248b194a6437a64ed17a10932459726f9

SHA256
032c39eff797953da6f624a9cd4a9dfcec043d358846aa59baf4968bbb67f49a

SHA512
bf748d8cc7c1aa0bb7abcdb5f3aff78d467c3ee885e6ccee477be3825042b2b0c1cf1f6af5db1d6419e4065c133b0fff49b4614a7c75c5e24527ee0ebb578a02

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 766609.crdownload

Filesize
5.4MB

MD5
def6aabef9580ff266bf92ec2a8a3a21

SHA1
6671f2bb26696066b4c281e1c67d9563c2102f31

SHA256
6f7ac2c17cfa22a550a146efb2db303293a17d0f7308a90b1161acb76602c2cc

SHA512
89725e0d082e1feb16ce5e01832434029168578a38f41c39716aa0ffbae9120f9c5e24e116ed6078de1dc6e2f55680f590b88c15dbef8fa0ee718366c31848de

Download Submit