parallax | 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2

General

Target

file.exe
Size

1.8MB
MD5

9c7cad9eda9e00f3ab502d8f02cba2ca
SHA1

a249034719737a3d6f4adda631e72c2145787949
SHA256

842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
SHA512

7892319b2872dec33031ab4a50efd2de5bf0a58641a011c091c57eaa62dc9957acd82765bfecec60a656736a79328c5fa1ef4733456bde3160ffc3cadffe712e
SSDEEP

24576:s7p3zW7nsL1lzFGE64M3ICpoy5hn5TbtgqzHNJltNupD2m9dDZYK:sV3zHXS3VpNh5TJgqrNJl4CEdGK

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 18 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/2344-9-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-10-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-11-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-12-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-13-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-14-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-15-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-16-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-17-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-18-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-19-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-20-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-21-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-22-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-23-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-24-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-25-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat
behavioral1/memory/2344-26-0x00000000031D0000-0x00000000031FC000-memory.dmp	parallax_rat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe
2344	file.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1200	2344	file.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2344

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-5-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1200-6-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2344-14-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-26-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-0-0x0000000000380000-0x0000000000400000-memory.dmp

Filesize
512KB

Download
memory/2344-7-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2344-8-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2344-9-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-10-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-11-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-12-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-16-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-1-0x000000007794F000-0x0000000077950000-memory.dmp

Filesize
4KB

Download
memory/2344-2-0x0000000000380000-0x0000000000400000-memory.dmp

Filesize
512KB

Download
memory/2344-13-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-17-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-18-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-19-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-20-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-21-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-22-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-23-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-24-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-25-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download
memory/2344-15-0x00000000031D0000-0x00000000031FC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing