parallax | 6c59c6cfadff62b8d3b301d97e91b6a65b3da0415641fbabf95e3404c8e4fcbd

General

Target

2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
Size

2.6MB
MD5

04c219134cffc77c39841c30704b2f6b
SHA1

1ac5a5b9a18575b0449745dd2d069f7a8b561d46
SHA256

6c59c6cfadff62b8d3b301d97e91b6a65b3da0415641fbabf95e3404c8e4fcbd
SHA512

58854e09a781150255d662a2a7968159b81a516dc05aa99a787da387b2baaba2c18e7187274e48b8cddb58aa920d7cdc4bdcab98a955f0a3bfd56fbc980b8361
SSDEEP

24576:0AKY7+JCMah2pE2Qd6fTmDCRiq2qRNQIB/1:0fYqUMahob/7mDCRV2iQI

Score

10^/10

parallax discovery rat

Malware Config

Signatures

ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 23 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral1/memory/2736-12-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-20-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-10-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-8-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-6-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-23-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-26-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-29-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-35-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-38-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-37-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-36-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-34-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-33-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-32-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-31-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-30-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-28-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-27-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-25-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-24-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-39-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat
behavioral1/memory/2736-44-0x0000000000400000-0x0000000000433000-memory.dmp	parallax_rat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 2736	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	31
PID 2204 wrote to memory of 1192	2204	2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe"
    3⤵
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-41-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2204-0-0x0000000001EA0000-0x0000000001F20000-memory.dmp

Filesize
512KB

Download
memory/2204-1-0x000000007767F000-0x0000000077680000-memory.dmp

Filesize
4KB

Download
memory/2204-2-0x0000000001EA0000-0x0000000001F20000-memory.dmp

Filesize
512KB

Download
memory/2204-3-0x0000000001F20000-0x0000000001F70000-memory.dmp

Filesize
320KB

Download
memory/2204-43-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/2204-42-0x0000000001EA0000-0x0000000001F20000-memory.dmp

Filesize
512KB

Download
memory/2736-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-36-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-22-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2736-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-19-0x000000007767F000-0x0000000077680000-memory.dmp

Filesize
4KB

Download
memory/2736-35-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-38-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-18-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2736-34-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-30-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-27-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2736-44-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing