Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
14/03/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
c8808d17e4ce35534a702f4b318684ef.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target c8808d17e4ce35534a702f4b318684ef.exe
- Size 6.5MB
- Sample240314-nkfrpsda39
- SHA256 d8eb5792d969c21c364da69eca1322ab5f63e0a39b0e542bad4ee95be873c296
- MD5 c8808d17e4ce35534a702f4b318684ef
- SHA1 3739e8d38d5598a0ac67bc06cbef408ba6e3aa8f
- SHA512 db966f831ea28ce8110e5ac9df0ebfcc5f3ba30500cd87e404b69929821174fc9431e48b3838b893a9da39b02d9ce1b7396d66a1fcec80ec8451c6e4eceefeb1
- SSDEEP 98304:OO5VI/yA/FFrWw//NtM/SmfGnp3b0o5O:/I/D/M/SmenP5O
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- ParallaxRat payload 19 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1420-7-0x00000000043D0000-0x0000000004403000-memory.dmp parallax_rat behavioral1/memory/2668-21-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-22-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-23-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-24-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-25-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-26-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-27-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-28-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-29-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-30-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-31-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-32-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-33-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-34-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-35-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-36-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-37-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat behavioral1/memory/2668-38-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\srs.job cmd.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1044 c8808d17e4ce35534a702f4b318684ef.exe 1420 notepad.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1420 notepad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1044 c8808d17e4ce35534a702f4b318684ef.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1044 wrote to memory of 1420 1044 c8808d17e4ce35534a702f4b318684ef.exe 28 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29 PID 1420 wrote to memory of 2668 1420 notepad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8808d17e4ce35534a702f4b318684ef.exe"C:\Users\Admin\AppData\Local\Temp\c8808d17e4ce35534a702f4b318684ef.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Drops file in Windows directory
PID:2668
-
-