parallax | 7070d544037059cd4008cd5d631f6ba78bed4084df55c9ef94eaaf5dcc600a3f

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
01/01/2026, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
Size 675KB
Sample260101-cyssmstpcz
SHA256 7070d544037059cd4008cd5d631f6ba78bed4084df55c9ef94eaaf5dcc600a3f
MD5 451189216479d2ef4c785d30e8712170
SHA1 96ec9f55d19be545cf3bff0cd8ec20c2d0e8a3f6
SHA512 79572239de740b8c36f2a127178d05527b0527cc08ccaf439ab11cd826d054eeddc6f1abd4af963bf566430c4dd2940689ed8cc23a123fa0b240aaf4439f3252
SSDEEP 12288:LGY+DE3pRg7fMV6KS3DVpRUKf3Lg40CaZpQfE/TC9C:xH3zg7fxdUKf3LN0LZes/W9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery parallax rat

Malware Config

Signatures

Parallax family
parallax
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

ParallaxRat payload 2 IoCs

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

resource	yara_rule
behavioral2/memory/1516-11-0x0000000000400000-0x00000000004B6000-memory.dmp	parallax_rat
behavioral2/memory/1516-15-0x0000000000400000-0x00000000004B6000-memory.dmp	parallax_rat

Program crash 17 IoCs

pid	pid_target	Process	procid_target
2996	1516	WerFault.exe	79
2612	1516	WerFault.exe	79
4480	1516	WerFault.exe	79
220	1516	WerFault.exe	79
1972	1516	WerFault.exe	79
4216	1516	WerFault.exe	79
3016	1516	WerFault.exe	79
4916	1516	WerFault.exe	79
2684	1516	WerFault.exe	79
4052	1516	WerFault.exe	79
4124	1516	WerFault.exe	79
5012	1516	WerFault.exe	79
320	1516	WerFault.exe	79
2668	1516	WerFault.exe	79
1816	1516	WerFault.exe	79
1596	1516	WerFault.exe	79
1948	1516	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
1516	SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 768
  2⤵
  - Program crash
  PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 808
  2⤵
  - Program crash
  PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 816
  2⤵
  - Program crash
  PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 860
  2⤵
  - Program crash
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 880
  2⤵
  - Program crash
  PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 868
  2⤵
  - Program crash
  PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 916
  2⤵
  - Program crash
  PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 936
  2⤵
  - Program crash
  PID:4916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 972
  2⤵
  - Program crash
  PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 944
  2⤵
  - Program crash
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 980
  2⤵
  - Program crash
  PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 984
  2⤵
  - Program crash
  PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 996
  2⤵
  - Program crash
  PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 936
  2⤵
  - Program crash
  PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 984
  2⤵
  - Program crash
  PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 988
  2⤵
  - Program crash
  PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1004
  2⤵
  - Program crash
  PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1516 -ip 1516
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1516 -ip 1516
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1516 -ip 1516
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1516 -ip 1516
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1516 -ip 1516
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1516 -ip 1516
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1516 -ip 1516
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1516 -ip 1516
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1516 -ip 1516
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1516 -ip 1516
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1516 -ip 1516
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1516 -ip 1516
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1516 -ip 1516
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1516 -ip 1516
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1516 -ip 1516
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1516 -ip 1516
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1516 -ip 1516
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/1516-2-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/1516-3-0x00000000024B0000-0x0000000002530000-memory.dmp

Download

memory/1516-4-0x0000000002530000-0x0000000002580000-memory.dmp

Download

memory/1516-5-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/1516-6-0x00000000024B0000-0x0000000002530000-memory.dmp

Download

memory/1516-7-0x00000000024B0000-0x0000000002530000-memory.dmp

Download

memory/1516-8-0x00000000024B0000-0x0000000002530000-memory.dmp

Download

memory/1516-11-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/1516-14-0x0000000000415000-0x000000000042B000-memory.dmp

Download

memory/1516-15-0x0000000000400000-0x00000000004B6000-memory.dmp

Download