parallax | 4ab16b326be00b6647ab0253f498dc286d6881b993cb5f95284c2db101b92c75

General

Target

fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
Size

3.4MB
MD5

fd1cef5cc1c58376c44c193b72163ec4
SHA1

a0d0a16dc003b101667e643a9958a8d71e71ac18
SHA256

4ab16b326be00b6647ab0253f498dc286d6881b993cb5f95284c2db101b92c75
SHA512

c5092a433e1681172757cfc387efa22bb9a54be6da1bd75deeb47ace0d147c020aa98d6400b6bf7ad5a99638a7f9638787b5b262ee31423a3d2a58c9559e958c
SSDEEP

24576:wqoti2coq8PhxEY/Syhf9wv8eWrkDVJpL3ynmsSCLlBwSSMJ13t7uWVOT44Iw4Ml:Ct7PBn9Nl2SSZWQ4Mk5+3KTUhn

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 19 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/2556-4-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-9-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-10-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-11-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-12-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-13-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-14-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-15-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-16-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-17-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-18-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-19-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-21-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-20-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-22-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-23-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-24-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-25-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral1/memory/2556-36-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CricketHelp.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2556	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	29
PID 2020 wrote to memory of 1176	2020	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"
    3⤵
    PID:2556

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-28-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/1176-26-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/2020-0-0x0000000000270000-0x00000000002EB000-memory.dmp

Filesize
492KB

Download
memory/2020-1-0x000000007705F000-0x0000000077060000-memory.dmp

Filesize
4KB

Download
memory/2020-5-0x0000000001FC0000-0x0000000002140000-memory.dmp

Filesize
1.5MB

Download
memory/2020-33-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2020-31-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/2020-32-0x0000000000270000-0x00000000002EB000-memory.dmp

Filesize
492KB

Download
memory/2020-29-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2020-30-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/2556-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-25-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-8-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2556-6-0x000000007705F000-0x0000000077060000-memory.dmp

Filesize
4KB

Download
memory/2556-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2556-36-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing