parallax | 500670f00b1e99426a3f5a49634475b69e3bca76442f7ad6db3b082fd094aecb

General

Target

337e300721c80ee6c114cc38b2ed786a.exe
Size

1.8MB
MD5

337e300721c80ee6c114cc38b2ed786a
SHA1

c6403b50de536acd4b7b90a4173ebe86bb86a001
SHA256

500670f00b1e99426a3f5a49634475b69e3bca76442f7ad6db3b082fd094aecb
SHA512

bdec678edfcdd29d0c8fb585cedd628ee6629410e79cfae3f8747066f9264c2f4ad92a35a31df4a48ab8e4682b47aca49fbff3ce22c9e80f6ccad5796f6530b4
SSDEEP

24576:DTEk3Xn9SWNNjE6zdAiYVs6hkBWa514UeWgzSULrGlK3Tacr+bZ47x:3nN4AAU6AoPQULrGlK3TcZ47

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 18 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

Processes:

resource	yara_rule
behavioral2/memory/4384-10-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-11-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-13-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-12-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-15-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-16-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-17-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-18-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-19-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-14-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-26-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-25-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-24-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-23-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-22-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-21-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-20-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat
behavioral2/memory/4384-38-0x0000000003380000-0x00000000033AC000-memory.dmp	parallax_rat

Drops startup file 2 IoCs

Processes:

DllHost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reun.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reun.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

337e300721c80ee6c114cc38b2ed786a.exe

pid	process
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe
4384	337e300721c80ee6c114cc38b2ed786a.exe

Suspicious use of WriteProcessMemory 1 IoCs

Processes:

337e300721c80ee6c114cc38b2ed786a.exe

description pid process target process

PID 4384 wrote to memory of 3464 4384 337e300721c80ee6c114cc38b2ed786a.exe Explorer.EXE

description	pid	process	target process
PID 4384 wrote to memory of 3464	4384	337e300721c80ee6c114cc38b2ed786a.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464

C:\Users\Admin\AppData\Local\Temp\337e300721c80ee6c114cc38b2ed786a.exe
"C:\Users\Admin\AppData\Local\Temp\337e300721c80ee6c114cc38b2ed786a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-7-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4384-17-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-3-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/4384-19-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-1-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/4384-6-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/4384-8-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/4384-10-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-9-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/4384-11-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-13-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-12-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-15-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-16-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-0-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4384-38-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-2-0x0000000077A82000-0x0000000077A83000-memory.dmp

Filesize
4KB

Download
memory/4384-14-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-26-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-25-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-24-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-23-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-22-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-21-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-20-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download
memory/4384-29-0x00000000033D0000-0x000000000348E000-memory.dmp

Filesize
760KB

Download
memory/4384-30-0x0000000003490000-0x0000000003759000-memory.dmp

Filesize
2.8MB

Download
memory/4384-31-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4384-32-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/4384-37-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/4384-18-0x0000000003380000-0x00000000033AC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads