Analysis
- user interaction
yes - max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 16:20
General
- Target AppvIsvSubsystems32.dll
- Size 1.1MB
- Sample261107-ts7s2sd18m
- SHA256 118b8305ff432328fb0a7bb8a871800913154fd165c87dca0f2c0d555b3f738a
Malware Config
Signatures
- Family: ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
- ParallaxRat payload 38 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
- Executes dropped EXE 1 IoCs
- Writes a Windows system DLL name to a user directory 2 TTPs 21 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AppvIsvSubsystems32.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AppvIsvSubsystems32.dll,#12⤵
- Writes a Windows system DLL name to a user directory
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dllhost.exe"C:\Windows\SysWOW64\Dllhost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Dllhost.exe"C:\Windows\SysWOW64\Dllhost.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
-
-
-
C:\Users\Admin\AppData\Roaming\RUp\rundll32.exeC:\Users\Admin\AppData\Roaming\RUp\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Hijack Execution Flow
1DLL Search Order Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Hijack Execution Flow
1DLL Search Order Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
rundll32.exe
memory/2668-24-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-32-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-23-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-45-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-25-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-26-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-29-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-30-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-9-0x0000000000700000-0x0000000000769000-memory.dmp
memory/2668-12-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-13-0x00000000023D0000-0x0000000002420000-memory.dmp
memory/2668-22-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-21-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-14-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-28-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-27-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-38-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-31-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-37-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-36-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-35-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-34-0x0000000002560000-0x000000000258D000-memory.dmp
memory/2668-33-0x0000000002560000-0x000000000258D000-memory.dmp
memory/3060-71-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-74-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-79-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-80-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-66-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-67-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-68-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-69-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-70-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-72-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-73-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-75-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-76-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-78-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-81-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-77-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-65-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-58-0x00000000023D0000-0x00000000023FD000-memory.dmp
memory/3060-52-0x0000000000660000-0x00000000006C9000-memory.dmp
memory/5440-42-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/5440-56-0x00000000039E0000-0x0000000003A60000-memory.dmp
memory/5440-50-0x00000000039E0000-0x0000000003A60000-memory.dmp
memory/5440-48-0x00000000039E0000-0x0000000003A60000-memory.dmp
memory/5440-47-0x0000000003630000-0x00000000039D1000-memory.dmp
memory/5440-46-0x0000000003440000-0x0000000003507000-memory.dmp
memory/5440-40-0x00000000039E0000-0x0000000003A60000-memory.dmp
memory/5440-44-0x0000000077E28000-0x0000000077E29000-memory.dmp
memory/5440-2-0x0000000001320000-0x0000000001321000-memory.dmp
memory/5440-43-0x0000000002CC0000-0x0000000002D40000-memory.dmp
memory/5440-41-0x0000000003A60000-0x0000000003AB0000-memory.dmp
memory/5440-3-0x00000000015D0000-0x00000000015D1000-memory.dmp
memory/5440-51-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/5440-4-0x0000000077E28000-0x0000000077E29000-memory.dmp
memory/5440-1-0x0000000002D40000-0x0000000002D90000-memory.dmp
memory/5440-0-0x0000000002CC0000-0x0000000002D40000-memory.dmp
memory/5440-5-0x0000000002CC0000-0x0000000002D40000-memory.dmp
memory/5440-6-0x00000000015D0000-0x00000000015D1000-memory.dmp
memory/5440-8-0x0000000002CC0000-0x0000000002D40000-memory.dmp
memory/5440-11-0x00000000015D0000-0x00000000015D1000-memory.dmp