hiverat | f49c3157e749609acf89ae453958b7d4f1fc165941e6e998271b0caee1f0cf35

Resubmissions

17-02-2021 19:37

210217-gyxbqal2ys 3

01-12-2020 14:48

201201-b4k57571mn 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
01-12-2020 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW SC.cmd.exe
Size

14KB
MD5

870ffbc1a133083f10fadf93cf28f706
SHA1

eddbe2346d62a6925634abd5dfe2d6f6b0ff3a5b
SHA256

f49c3157e749609acf89ae453958b7d4f1fc165941e6e998271b0caee1f0cf35
SHA512

f6b65b12ccadc42cfecc2130399cab9beadf4447dfbae09c523c3e7dc7eacf881be2d7590942f49e1270c3d8c3d793cfb293006696300c56ab5320b66d8f835b

Score

10^/10

hiverat evasion persistence rat stealer trojan

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NEW SC.cmd.exe\""	NEW SC.cmd.exe

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

HiveRAT Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2476-51-0x0000000000400000-0x0000000000454000-memory.dmp	family_hiverat
behavioral2/memory/2476-52-0x000000000044CD9E-mapping.dmp	family_hiverat
behavioral2/memory/2476-53-0x0000000000400000-0x0000000000454000-memory.dmp	family_hiverat

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NEW SC.cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NEW SC.cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEW SC.cmd.exe	NEW SC.cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEW SC.cmd.exe	NEW SC.cmd.exe

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	NEW SC.cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEW SC.cmd.exe = "0"	NEW SC.cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe = "0"	NEW SC.cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	NEW SC.cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	NEW SC.cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	NEW SC.cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	NEW SC.cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	NEW SC.cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	NEW SC.cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	NEW SC.cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	NEW SC.cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Avast Essentials = "C:\\Users\\Admin\\AppData\\Roaming\\Avast.exe"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEW SC.cmd.exe"	NEW SC.cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\NEW SC.cmd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEW SC.cmd.exe"	NEW SC.cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEW SC.cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	NEW SC.cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 2476	4644	NEW SC.cmd.exe	91

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4200	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	NEW SC.cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4280	powershell.exe
3244	powershell.exe
1900	powershell.exe
4328	powershell.exe
4280	powershell.exe
1900	powershell.exe
3244	powershell.exe
4328	powershell.exe
4644	NEW SC.cmd.exe
4644	NEW SC.cmd.exe
4280	powershell.exe
1900	powershell.exe
4328	powershell.exe
3244	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	NEW SC.cmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	NEW SC.cmd.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	2476	NEW SC.cmd.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3632	4644	NEW SC.cmd.exe	75
PID 4644 wrote to memory of 3632	4644	NEW SC.cmd.exe	75
PID 4644 wrote to memory of 3632	4644	NEW SC.cmd.exe	75
PID 3632 wrote to memory of 4200	3632	cmd.exe	77
PID 3632 wrote to memory of 4200	3632	cmd.exe	77
PID 3632 wrote to memory of 4200	3632	cmd.exe	77
PID 4644 wrote to memory of 3244	4644	NEW SC.cmd.exe	82
PID 4644 wrote to memory of 3244	4644	NEW SC.cmd.exe	82
PID 4644 wrote to memory of 3244	4644	NEW SC.cmd.exe	82
PID 4644 wrote to memory of 4280	4644	NEW SC.cmd.exe	84
PID 4644 wrote to memory of 4280	4644	NEW SC.cmd.exe	84
PID 4644 wrote to memory of 4280	4644	NEW SC.cmd.exe	84
PID 4644 wrote to memory of 1900	4644	NEW SC.cmd.exe	86
PID 4644 wrote to memory of 1900	4644	NEW SC.cmd.exe	86
PID 4644 wrote to memory of 1900	4644	NEW SC.cmd.exe	86
PID 4644 wrote to memory of 4328	4644	NEW SC.cmd.exe	88
PID 4644 wrote to memory of 4328	4644	NEW SC.cmd.exe	88
PID 4644 wrote to memory of 4328	4644	NEW SC.cmd.exe	88
PID 4644 wrote to memory of 2376	4644	NEW SC.cmd.exe	90
PID 4644 wrote to memory of 2376	4644	NEW SC.cmd.exe	90
PID 4644 wrote to memory of 2376	4644	NEW SC.cmd.exe	90
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 4644 wrote to memory of 2476	4644	NEW SC.cmd.exe	91
PID 2476 wrote to memory of 1256	2476	NEW SC.cmd.exe	92
PID 2476 wrote to memory of 1256	2476	NEW SC.cmd.exe	92
PID 2476 wrote to memory of 1256	2476	NEW SC.cmd.exe	92
PID 2476 wrote to memory of 4320	2476	NEW SC.cmd.exe	93
PID 2476 wrote to memory of 4320	2476	NEW SC.cmd.exe	93
PID 2476 wrote to memory of 4320	2476	NEW SC.cmd.exe	93
PID 1448 wrote to memory of 4516	1448	explorer.exe	95
PID 1448 wrote to memory of 4516	1448	explorer.exe	95

C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe
"C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 4.638
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4.638
    3⤵
    - Delays execution with timeout.exe
    PID:4200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEW SC.cmd.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEW SC.cmd.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEW SC.cmd.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe"
  2⤵
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW SC.cmd.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution2.vbs"
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Execution.vbs
    3⤵
    PID:4320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution.vbs"
  2⤵
  - Adds Run key to start application
  PID:4516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-92-0x0000000009110000-0x0000000009111000-memory.dmp

Filesize
4KB

Download
memory/1900-96-0x0000000009480000-0x0000000009481000-memory.dmp

Filesize
4KB

Download
memory/1900-18-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/1900-109-0x0000000009650000-0x0000000009651000-memory.dmp

Filesize
4KB

Download
memory/1900-71-0x0000000009350000-0x0000000009383000-memory.dmp

Filesize
204KB

Download
memory/2476-51-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2476-56-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-63-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/2476-53-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3244-34-0x0000000007C50000-0x0000000007C51000-memory.dmp

Filesize
4KB

Download
memory/3244-123-0x0000000009590000-0x0000000009591000-memory.dmp

Filesize
4KB

Download
memory/3244-30-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/3244-19-0x00000000073B0000-0x00000000073B1000-memory.dmp

Filesize
4KB

Download
memory/3244-16-0x0000000006BB0000-0x0000000006BB1000-memory.dmp

Filesize
4KB

Download
memory/3244-15-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/4280-45-0x0000000008890000-0x0000000008891000-memory.dmp

Filesize
4KB

Download
memory/4280-17-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/4280-115-0x0000000009900000-0x0000000009901000-memory.dmp

Filesize
4KB

Download
memory/4280-43-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Filesize
4KB

Download
memory/4280-27-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/4280-54-0x00000000086A0000-0x00000000086A1000-memory.dmp

Filesize
4KB

Download
memory/4328-24-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/4644-2-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/4644-10-0x0000000009490000-0x0000000009491000-memory.dmp

Filesize
4KB

Download
memory/4644-9-0x0000000009920000-0x0000000009921000-memory.dmp

Filesize
4KB

Download
memory/4644-8-0x0000000007070000-0x0000000007171000-memory.dmp

Filesize
1.0MB

Download
memory/4644-5-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/4644-3-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download