Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03-03-2024 23:16

General

  • Target

    b0a383649505829364efcbf05d137cb6.exe

  • Size

    52KB

  • MD5

    b0a383649505829364efcbf05d137cb6

  • SHA1

    94339534d586146aef7d328dd857813251973b34

  • SHA256

    d717c14daab8c2ca198c247568f63fe92448f104588545c9f689603551d0251b

  • SHA512

    0bbd1381a1f5d022c499beacc74db3553e6fb8b05f6499705e9ea66b25ebc14faa98424067365bd30ded69ece1d0bc7eb1db54d2b4ab9c3262a4a0a0b6c336ec

  • SSDEEP

    384:Yiraroxo8brZBJGAvveCnu9wB1jxA4WnAW:YEbvJv490C

Score
10/10

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0a383649505829364efcbf05d137cb6.exe
    "C:\Users\Admin\AppData\Local\Temp\b0a383649505829364efcbf05d137cb6.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SecurityHealth" /tr '"C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "SecurityHealth" /tr '"C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:1712
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6EE9.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2728
      • C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe
        "C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp6EE9.tmp.bat

    Filesize

    167B

    MD5

    6f436fe3d3648464156ceb272f76d6ee

    SHA1

    f1e9b2fbe22d950ebe60065d9fdcc02afb817cb9

    SHA256

    2e9a8d04e347d6292b2b910abb9274f4fd366802cc081540e65494ae841068ed

    SHA512

    48038733304a3b7d77e35ca7d7a2bc0ce50a45f9182cbe0a66ae4fe4708276a1fda2b37b1b0312802b537533bdc8046a5fdcbc20f97c3afeb6a3b79245e93aef

  • C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe

    Filesize

    52KB

    MD5

    b0a383649505829364efcbf05d137cb6

    SHA1

    94339534d586146aef7d328dd857813251973b34

    SHA256

    d717c14daab8c2ca198c247568f63fe92448f104588545c9f689603551d0251b

    SHA512

    0bbd1381a1f5d022c499beacc74db3553e6fb8b05f6499705e9ea66b25ebc14faa98424067365bd30ded69ece1d0bc7eb1db54d2b4ab9c3262a4a0a0b6c336ec

  • memory/1708-0-0x0000000000DA0000-0x0000000000DB2000-memory.dmp

    Filesize

    72KB

  • memory/1708-1-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

    Filesize

    9.9MB

  • memory/1708-2-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

    Filesize

    9.9MB

  • memory/1708-12-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

    Filesize

    9.9MB

  • memory/2796-15-0x0000000000F10000-0x0000000000F22000-memory.dmp

    Filesize

    72KB

  • memory/2796-16-0x000007FEF4760000-0x000007FEF514C000-memory.dmp

    Filesize

    9.9MB

  • memory/2796-17-0x000000001B020000-0x000000001B0A0000-memory.dmp

    Filesize

    512KB

  • memory/2796-18-0x000007FEF4760000-0x000007FEF514C000-memory.dmp

    Filesize

    9.9MB

  • memory/2796-19-0x000000001B020000-0x000000001B0A0000-memory.dmp

    Filesize

    512KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.