Analysis
- max time kernel
290s - max time network
297s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
21/03/2024, 22:36
General
- Target 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe
- Size 1.8MB
- Sample240321-2jbcgscc42
- SHA256 842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
Malware Config
Signatures
- ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
- ParallaxRat payload 18 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
- Drops startup file 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe"C:\Users\Admin\AppData\Local\Temp\842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3300-5-0x0000000000D90000-0x0000000000D91000-memory.dmp
memory/4416-14-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-24-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-1-0x0000000077B02000-0x0000000077B03000-memory.dmp
memory/4416-6-0x0000000002360000-0x0000000002361000-memory.dmp
memory/4416-7-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/4416-8-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-9-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-10-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-11-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-12-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-13-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-0-0x0000000002460000-0x00000000024E0000-memory.dmp
memory/4416-2-0x0000000002460000-0x00000000024E0000-memory.dmp
memory/4416-17-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-15-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-19-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-18-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-22-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-20-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-21-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-23-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-16-0x00000000024E0000-0x000000000250C000-memory.dmp
memory/4416-26-0x0000000002F70000-0x000000000301E000-memory.dmp
memory/4416-27-0x0000000003020000-0x0000000003269000-memory.dmp
memory/4416-31-0x00000000024E0000-0x000000000250C000-memory.dmp