Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/08/2024, 20:42 UTC
General
-
Target
2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe
-
Size
2.6MB
-
MD5
04c219134cffc77c39841c30704b2f6b
-
SHA1
1ac5a5b9a18575b0449745dd2d069f7a8b561d46
-
SHA256
6c59c6cfadff62b8d3b301d97e91b6a65b3da0415641fbabf95e3404c8e4fcbd
-
SHA512
58854e09a781150255d662a2a7968159b81a516dc05aa99a787da387b2baaba2c18e7187274e48b8cddb58aa920d7cdc4bdcab98a955f0a3bfd56fbc980b8361
-
SSDEEP
24576:0AKY7+JCMah2pE2Qd6fTmDCRiq2qRNQIB/1:0fYqUMahob/7mDCRV2iQI
Malware Config
Signatures
-
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
-
ParallaxRat payload 19 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_04c219134cffc77c39841c30704b2f6b_icedid.exe"3⤵
-
-
Network
-
DNS134.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse -
DNS240.143.123.92.in-addr.arpaRemote address:8.8.8.8:53Request240.143.123.92.in-addr.arpaIN PTRResponse240.143.123.92.in-addr.arpaIN PTRa92-123-143-240deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS0.205.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
45.32.94.58:80
-
8.8.8.8:53134.32.126.40.in-addr.arpadns
DNS Request
134.32.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53240.143.123.92.in-addr.arpadns
DNS Request
240.143.123.92.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:530.205.248.87.in-addr.arpadns
DNS Request
0.205.248.87.in-addr.arpa
-
8.8.8.8:5311.227.111.52.in-addr.arpadns
DNS Request
11.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
2.6MB
-
Filesize
960KB
-
Filesize
760KB
-
Filesize
512KB
-
Filesize
2.8MB
-
Filesize
512KB
-
Filesize
4KB