Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe
Resource
win10v2004-20230703-en
General
-
Target
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe
-
Size
1.5MB
-
MD5
c90ab34fbac37c0b09dc5dea5818d803
-
SHA1
028394346e783de10ea614d9d07cad27b75188f3
-
SHA256
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
-
SHA512
8e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49
-
SSDEEP
24576:LVK2zY2X82tmkWCIF2S3bwLuRYbFIEmJWq83GPG0URj:LY6p3W5HxGFIE66V
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1920-0-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral2/memory/2944-11-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral2/memory/3868-19-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Aqiyq.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Aqiyq.exe -
Executes dropped EXE 2 IoCs
pid Process 2944 Aqiyq.exe 3868 Aqiyq.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Aqiyq.exe File opened (read-only) \??\Z: Aqiyq.exe File opened (read-only) \??\E: Aqiyq.exe File opened (read-only) \??\H: Aqiyq.exe File opened (read-only) \??\J: Aqiyq.exe File opened (read-only) \??\K: Aqiyq.exe File opened (read-only) \??\O: Aqiyq.exe File opened (read-only) \??\S: Aqiyq.exe File opened (read-only) \??\L: Aqiyq.exe File opened (read-only) \??\N: Aqiyq.exe File opened (read-only) \??\Y: Aqiyq.exe File opened (read-only) \??\G: Aqiyq.exe File opened (read-only) \??\P: Aqiyq.exe File opened (read-only) \??\R: Aqiyq.exe File opened (read-only) \??\X: Aqiyq.exe File opened (read-only) \??\W: Aqiyq.exe File opened (read-only) \??\B: Aqiyq.exe File opened (read-only) \??\I: Aqiyq.exe File opened (read-only) \??\M: Aqiyq.exe File opened (read-only) \??\Q: Aqiyq.exe File opened (read-only) \??\T: Aqiyq.exe File opened (read-only) \??\U: Aqiyq.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Aqiyq.exe f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe File opened for modification C:\Windows\Aqiyq.exe f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Aqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Aqiyq.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4508 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe 3868 Aqiyq.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3868 Aqiyq.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1920 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe Token: SeLoadDriverPrivilege 3868 Aqiyq.exe Token: 33 3868 Aqiyq.exe Token: SeIncBasePriorityPrivilege 3868 Aqiyq.exe Token: 33 3868 Aqiyq.exe Token: SeIncBasePriorityPrivilege 3868 Aqiyq.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3952 1920 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 84 PID 1920 wrote to memory of 3952 1920 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 84 PID 1920 wrote to memory of 3952 1920 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 84 PID 2944 wrote to memory of 3868 2944 Aqiyq.exe 85 PID 2944 wrote to memory of 3868 2944 Aqiyq.exe 85 PID 2944 wrote to memory of 3868 2944 Aqiyq.exe 85 PID 3952 wrote to memory of 4508 3952 cmd.exe 87 PID 3952 wrote to memory of 4508 3952 cmd.exe 87 PID 3952 wrote to memory of 4508 3952 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe"C:\Users\Admin\AppData\Local\Temp\f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\F25114~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:4508
-
-
-
C:\Windows\Aqiyq.exeC:\Windows\Aqiyq.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\Aqiyq.exeC:\Windows\Aqiyq.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5c90ab34fbac37c0b09dc5dea5818d803
SHA1028394346e783de10ea614d9d07cad27b75188f3
SHA256f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
SHA5128e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49
-
Filesize
1.5MB
MD5c90ab34fbac37c0b09dc5dea5818d803
SHA1028394346e783de10ea614d9d07cad27b75188f3
SHA256f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
SHA5128e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49
-
Filesize
1.5MB
MD5c90ab34fbac37c0b09dc5dea5818d803
SHA1028394346e783de10ea614d9d07cad27b75188f3
SHA256f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
SHA5128e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49