parallax | 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2

General

Target

file.exe
Size

1.8MB
MD5

9c7cad9eda9e00f3ab502d8f02cba2ca
SHA1

a249034719737a3d6f4adda631e72c2145787949
SHA256

842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
SHA512

7892319b2872dec33031ab4a50efd2de5bf0a58641a011c091c57eaa62dc9957acd82765bfecec60a656736a79328c5fa1ef4733456bde3160ffc3cadffe712e
SSDEEP

24576:s7p3zW7nsL1lzFGE64M3ICpoy5hn5TbtgqzHNJltNupD2m9dDZYK:sV3zHXS3VpNh5TJgqrNJl4CEdGK

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 18 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

Processes:

resource	yara_rule
behavioral2/memory/3528-8-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-9-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-10-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-11-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-12-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-13-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-14-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-15-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-17-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-16-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-18-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-19-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-20-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-21-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-22-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-23-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-24-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat
behavioral2/memory/3528-32-0x00000000030B0000-0x00000000030DC000-memory.dmp	parallax_rat

Drops startup file 2 IoCs

Processes:

DllHost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

file.exe

pid	process
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe
3528	file.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3380 Explorer.EXE
Suspicious use of WriteProcessMemory 1 IoCs

Processes:

file.exe

description pid process target process

PID 3528 wrote to memory of 3380 3528 file.exe Explorer.EXE

pid	process
3380	Explorer.EXE

description	pid	process	target process
PID 3528 wrote to memory of 3380	3528	file.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3380

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-6-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/3528-17-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-32-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-15-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-1-0x0000000077162000-0x0000000077163000-memory.dmp

Filesize
4KB

Download
memory/3528-7-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/3528-8-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-9-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-10-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-11-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-12-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-13-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-14-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-5-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/3528-2-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/3528-24-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-18-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-19-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-20-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-21-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-22-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-23-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-16-0x00000000030B0000-0x00000000030DC000-memory.dmp

Filesize
176KB

Download
memory/3528-25-0x0000000002750000-0x0000000002840000-memory.dmp

Filesize
960KB

Download
memory/3528-26-0x00000000030F0000-0x00000000031AE000-memory.dmp

Filesize
760KB

Download
memory/3528-27-0x00000000031B0000-0x0000000003479000-memory.dmp

Filesize
2.8MB

Download
memory/3528-31-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/3528-0-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads