Overview

overview

10

Static

static

3

b0a3836495...b6.exe

windows7-x64

10

b0a3836495...b6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-03-2024 23:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b0a383649505829364efcbf05d137cb6.exe

  • Size

    52KB

  • MD5

    b0a383649505829364efcbf05d137cb6

  • SHA1

    94339534d586146aef7d328dd857813251973b34

  • SHA256

    d717c14daab8c2ca198c247568f63fe92448f104588545c9f689603551d0251b

  • SHA512

    0bbd1381a1f5d022c499beacc74db3553e6fb8b05f6499705e9ea66b25ebc14faa98424067365bd30ded69ece1d0bc7eb1db54d2b4ab9c3262a4a0a0b6c336ec

  • SSDEEP

    384:Yiraroxo8brZBJGAvveCnu9wB1jxA4WnAW:YEbvJv490C

Score
10/10
parallaxrat

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

    ratparallax
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0a383649505829364efcbf05d137cb6.exe
    "C:\Users\Admin\AppData\Local\Temp\b0a383649505829364efcbf05d137cb6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SecurityHealth" /tr '"C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "SecurityHealth" /tr '"C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:5072
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB18D.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4380
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4680
      • C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe
        "C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB18D.tmp.bat
    Filesize

    167B

    MD5

    ae90a2ce848235c8a3d2bd92572a7240

    SHA1

    e8513fa081850aa37c55e4ea7067dcb3cd9ea3bf

    SHA256

    1579c67f96635e057d855c9306af8059476d93e437096a3c86c4f7398bc84c9a

    SHA512

    2e2c2f82d9455a58f67f5345346b832c67963512f4896d59af464ccf1bdbd8b7753adf4958440acdf179c75b27a6dfbbf031f8d3e59f9b9d1b28a55892859a82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Security\SecurityHealth.exe
    Filesize

    52KB

    MD5

    b0a383649505829364efcbf05d137cb6

    SHA1

    94339534d586146aef7d328dd857813251973b34

    SHA256

    d717c14daab8c2ca198c247568f63fe92448f104588545c9f689603551d0251b

    SHA512

    0bbd1381a1f5d022c499beacc74db3553e6fb8b05f6499705e9ea66b25ebc14faa98424067365bd30ded69ece1d0bc7eb1db54d2b4ab9c3262a4a0a0b6c336ec

    Download Submit

  • memory/1144-0-0x00000213B5C90000-0x00000213B5CA2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1144-1-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1144-2-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1144-7-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1696-12-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1696-13-0x0000024CB3090000-0x0000024CB30A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1696-14-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1696-15-0x0000024CB3090000-0x0000024CB30A0000-memory.dmp

    Filesize

    64KB

    Download