Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 12:34
General
- Target WindowsCodecs.dll
- Size 24.2MB
- Sample260924-pr95ka1z5l
- SHA256 9cbd85e3e0e386d105a24669a74b907ab4c60cbfaf3651fd7adefed19afa47db
Malware Config
Signatures
- Family: ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
- ParallaxRat payload 19 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsCodecs.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsCodecs.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\pro\rundll32.exeC:\Users\Admin\AppData\Roaming\pro\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSFT_FileDirectoryConfiguration.Registration.mfl
{A5A7C794-3D59-41DF-915F-19ACDA526FC9}4105.bin
prncnfg.vbs
prnport.vbs
Microsoft.Windows.Firewall.Commands.Resources.dll
dpnathlp.dll
comexp.msc
compmgmt.msc
lipeula.rtf
gpedit.msc
rsop.msc
rundll32.exe
storage.dll
UserStateWMIProvider.mfl
mispace_uninstall.mfl
MsDtcWmi.mfl
csv.xsl
hform.xsl
htable.xsl
mof.xsl
xml.xsl
memory/1680-7627-0x0000000000930000-0x0000000000997000-memory.dmp
memory/1680-7654-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7628-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7660-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7633-0x0000000000930000-0x0000000000997000-memory.dmp
memory/1680-7632-0x0000000000CE0000-0x0000000000D30000-memory.dmp
memory/1680-7642-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7641-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7634-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7643-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7657-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7656-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7655-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7644-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7653-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7652-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7651-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7650-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7649-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7648-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7647-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7646-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1680-7645-0x0000000000400000-0x000000000042D000-memory.dmp
memory/3336-5-0x0000000074050000-0x0000000075861000-memory.dmp
memory/3336-7630-0x00000000029F0000-0x0000000002AAE000-memory.dmp
memory/3336-7631-0x0000000002BB0000-0x0000000002E79000-memory.dmp
memory/3336-1-0x0000000074050000-0x0000000075861000-memory.dmp
memory/3336-0-0x000000007532F000-0x0000000075331000-memory.dmp