parallax | 4ab16b326be00b6647ab0253f498dc286d6881b993cb5f95284c2db101b92c75

General

Target

fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
Size

3.4MB
MD5

fd1cef5cc1c58376c44c193b72163ec4
SHA1

a0d0a16dc003b101667e643a9958a8d71e71ac18
SHA256

4ab16b326be00b6647ab0253f498dc286d6881b993cb5f95284c2db101b92c75
SHA512

c5092a433e1681172757cfc387efa22bb9a54be6da1bd75deeb47ace0d147c020aa98d6400b6bf7ad5a99638a7f9638787b5b262ee31423a3d2a58c9559e958c
SSDEEP

24576:wqoti2coq8PhxEY/Syhf9wv8eWrkDVJpL3ynmsSCLlBwSSMJ13t7uWVOT44Iw4Ml:Ct7PBn9Nl2SSZWQ4Mk5+3KTUhn

Score

10^/10

parallax rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 19 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

Processes:

resource	yara_rule
behavioral2/memory/3712-7-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-12-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-17-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-18-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-19-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-20-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-21-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-22-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-23-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-24-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-27-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-26-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-25-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-28-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-29-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-30-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-31-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-32-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat
behavioral2/memory/3712-38-0x0000000000400000-0x0000000000424000-memory.dmp	parallax_rat

Drops startup file 2 IoCs

Processes:

DllHost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CricketHelp.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CricketHelp.exe	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe

pid	process
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe

description	pid	process	target process
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3712	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
PID 372 wrote to memory of 3360	372	fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:372

C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd1cef5cc1c58376c44c193b72163ec4_JaffaCakes118.exe"
3⤵
PID:3712

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-16-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download
memory/372-1-0x00000000778E2000-0x00000000778E3000-memory.dmp

Filesize
4KB

Download
memory/372-2-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/372-3-0x00000000026F0000-0x00000000027E0000-memory.dmp

Filesize
960KB

Download
memory/372-6-0x0000000002440000-0x00000000025E3000-memory.dmp

Filesize
1.6MB

Download
memory/372-37-0x0000000002380000-0x00000000023FB000-memory.dmp

Filesize
492KB

Download
memory/372-36-0x0000000003210000-0x00000000034D9000-memory.dmp

Filesize
2.8MB

Download
memory/372-35-0x0000000003150000-0x000000000320E000-memory.dmp

Filesize
760KB

Download
memory/372-0-0x0000000002380000-0x00000000023FB000-memory.dmp

Filesize
492KB

Download
memory/372-15-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/372-14-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/3360-13-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/3712-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-25-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-27-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-26-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-28-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-29-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-11-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3712-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-9-0x00000000778E2000-0x00000000778E3000-memory.dmp

Filesize
4KB

Download
memory/3712-38-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads