parallax | 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2

General

Target

file.exe
Size

1.8MB
MD5

9c7cad9eda9e00f3ab502d8f02cba2ca
SHA1

a249034719737a3d6f4adda631e72c2145787949
SHA256

842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
SHA512

7892319b2872dec33031ab4a50efd2de5bf0a58641a011c091c57eaa62dc9957acd82765bfecec60a656736a79328c5fa1ef4733456bde3160ffc3cadffe712e
SSDEEP

24576:s7p3zW7nsL1lzFGE64M3ICpoy5hn5TbtgqzHNJltNupD2m9dDZYK:sV3zHXS3VpNh5TJgqrNJl4CEdGK

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 18 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/1564-8-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-9-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-10-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-11-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-12-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-13-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-14-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-17-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-16-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-15-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-18-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-19-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-20-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-21-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-22-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-24-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-23-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat
behavioral2/memory/1564-32-0x00000000030A0000-0x00000000030CC000-memory.dmp	parallax_rat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe
1564	file.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3556	Explorer.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3556	1564	file.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3556
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-14-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-32-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-0-0x0000000002440000-0x00000000024C0000-memory.dmp

Filesize
512KB

Download
memory/1564-8-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1564-17-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-5-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/1564-9-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-10-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-11-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-12-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-13-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-2-0x0000000002440000-0x00000000024C0000-memory.dmp

Filesize
512KB

Download
memory/1564-1-0x0000000077392000-0x0000000077393000-memory.dmp

Filesize
4KB

Download
memory/1564-24-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-15-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-18-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-19-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-20-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-21-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-22-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-16-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-23-0x00000000030A0000-0x00000000030CC000-memory.dmp

Filesize
176KB

Download
memory/1564-26-0x00000000030E0000-0x000000000319E000-memory.dmp

Filesize
760KB

Download
memory/1564-27-0x00000000031A0000-0x0000000003469000-memory.dmp

Filesize
2.8MB

Download
memory/1564-31-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/3556-6-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing