Analysis
-
max time kernel
59s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 11:43
Static task
static1
1 signatures
General
-
Target
842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe
-
Size
1.8MB
-
MD5
9c7cad9eda9e00f3ab502d8f02cba2ca
-
SHA1
a249034719737a3d6f4adda631e72c2145787949
-
SHA256
842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
-
SHA512
7892319b2872dec33031ab4a50efd2de5bf0a58641a011c091c57eaa62dc9957acd82765bfecec60a656736a79328c5fa1ef4733456bde3160ffc3cadffe712e
-
SSDEEP
24576:s7p3zW7nsL1lzFGE64M3ICpoy5hn5TbtgqzHNJltNupD2m9dDZYK:sV3zHXS3VpNh5TJgqrNJl4CEdGK
Malware Config
Signatures
-
ParallaxRat payload 18 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/3940-8-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-9-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-10-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-11-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-12-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-14-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-15-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-13-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-16-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-17-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-18-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-19-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-20-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-21-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-22-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-23-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-24-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat behavioral1/memory/3940-46-0x00000000030C0000-0x00000000030EC000-memory.dmp parallax_rat -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe DllHost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\geargul.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3452 Explorer.EXE 2404 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeDebugPrivilege 2404 taskmgr.exe Token: SeSystemProfilePrivilege 2404 taskmgr.exe Token: SeCreateGlobalPrivilege 2404 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 3452 Explorer.EXE 3452 Explorer.EXE 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3940 wrote to memory of 3452 3940 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe 57 PID 3452 wrote to memory of 2404 3452 Explorer.EXE 106 PID 3452 wrote to memory of 2404 3452 Explorer.EXE 106
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe"C:\Users\Admin\AppData\Local\Temp\842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59c7cad9eda9e00f3ab502d8f02cba2ca
SHA1a249034719737a3d6f4adda631e72c2145787949
SHA256842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
SHA5127892319b2872dec33031ab4a50efd2de5bf0a58641a011c091c57eaa62dc9957acd82765bfecec60a656736a79328c5fa1ef4733456bde3160ffc3cadffe712e