Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 12:34
General
- Target WindowsCodecs.dll
- Size 24.2MB
- Sample260924-pr95ka1z5l
- SHA256 9cbd85e3e0e386d105a24669a74b907ab4c60cbfaf3651fd7adefed19afa47db
Malware Config
Signatures
- Family: ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
- ParallaxRat payload 20 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsCodecs.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsCodecs.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\pro\rundll32.exeC:\Users\Admin\AppData\Roaming\pro\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
rundll32.exe
memory/2408-10-0x0000000002D70000-0x0000000002E37000-memory.dmp
memory/2408-1-0x0000000073B30000-0x0000000075341000-memory.dmp
memory/2408-2-0x0000000073B30000-0x0000000075341000-memory.dmp
memory/2408-11-0x0000000002F00000-0x00000000032A1000-memory.dmp
memory/2408-0-0x0000000074E0F000-0x0000000074E11000-memory.dmp
memory/2504-33-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-30-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-20-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-19-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-12-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-36-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-35-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-34-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-9-0x0000000000600000-0x0000000000667000-memory.dmp
memory/2504-32-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-31-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-8-0x0000000000A70000-0x0000000000AC0000-memory.dmp
memory/2504-29-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-28-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-27-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-26-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-25-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-24-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-23-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-22-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-21-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-6-0x0000000000AC0000-0x0000000000AED000-memory.dmp
memory/2504-5-0x0000000000600000-0x0000000000667000-memory.dmp
memory/2504-38-0x0000000000AC0000-0x0000000000AED000-memory.dmp