hiverat | 9dd4a95031cc128d8ca15aa0daba60ae2f897e56483eb70bc7859cebcdd60cda

General

Target

Console Sniffer Cracked/ConsoleSniffer v4.1 installer.exe
Size

7.9MB
MD5

61d8ca5f3ec331a08c9032840b99eb5b
SHA1

dc73d785c3e899a58a5616239e89d3fd3d49bb93
SHA256

a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811
SHA512

f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2684-123-0x000000000044C24E-mapping.dmp	family_hiverat
behavioral2/memory/2684-126-0x0000000000430000-0x0000000000484000-memory.dmp	family_hiverat

Executes dropped EXE 2 IoCs

Processes:

File.exesvhost.exe

pid process

4052 File.exe
2684 svhost.exe

pid	process
4052	File.exe
2684	svhost.exe

Drops startup file 1 IoCs

Processes:

ConsoleSniffer v4.1 installer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk	ConsoleSniffer v4.1 installer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ConsoleSniffer v4.1 installer.exe

description pid process target process

PID 3944 set thread context of 2684 3944 ConsoleSniffer v4.1 installer.exe svhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3900 timeout.exe
NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe

description	pid	process	target process
PID 3944 set thread context of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe

pid	process
3900	timeout.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ConsoleSniffer v4.1 installer.exe

pid	process
3944	ConsoleSniffer v4.1 installer.exe
3944	ConsoleSniffer v4.1 installer.exe
3944	ConsoleSniffer v4.1 installer.exe
3944	ConsoleSniffer v4.1 installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svhost.exe

pid process

2684 svhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ConsoleSniffer v4.1 installer.exesvhost.exe

description pid process

Token: SeDebugPrivilege 3944 ConsoleSniffer v4.1 installer.exe
Token: SeDebugPrivilege 2684 svhost.exe

pid	process
2684	svhost.exe

description	pid	process
Token: SeDebugPrivilege	3944	ConsoleSniffer v4.1 installer.exe
Token: SeDebugPrivilege	2684	svhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

ConsoleSniffer v4.1 installer.execmd.exe

description	pid	process	target process
PID 3944 wrote to memory of 4052	3944	ConsoleSniffer v4.1 installer.exe	File.exe
PID 3944 wrote to memory of 4052	3944	ConsoleSniffer v4.1 installer.exe	File.exe
PID 3944 wrote to memory of 4052	3944	ConsoleSniffer v4.1 installer.exe	File.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 3944 wrote to memory of 2336	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 2336	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 2336	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 3472	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 3472	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 3472	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 3964	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 3964	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3944 wrote to memory of 3964	3944	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 3964 wrote to memory of 3900	3964	cmd.exe	timeout.exe
PID 3964 wrote to memory of 3900	3964	cmd.exe	timeout.exe
PID 3964 wrote to memory of 3900	3964	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Console Sniffer Cracked\ConsoleSniffer v4.1 installer.exe
"C:\Users\Admin\AppData\Local\Temp\Console Sniffer Cracked\ConsoleSniffer v4.1 installer.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Console Sniffer Cracked/ConsoleSniffer v4.1 installer.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:3900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe

MD5
61d8ca5f3ec331a08c9032840b99eb5b

SHA1
dc73d785c3e899a58a5616239e89d3fd3d49bb93

SHA256
a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811

SHA512
f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat

MD5
bfcbf382f036462e63f307ca4ae280c7

SHA1
ffe98d15fa5ea205220d6bc105e317253a6ea003

SHA256
2c3dd84c3ce3e529117e611d8caf4fc7f5a902840350f4ca524c251a2152c727

SHA512
1b912652cc989541b396df5fd6bf207a4cf4ed891dc6e3223b8d0497c19a2589cb644c4c96ca01d882a7643f240c566966d84e46d77e9ad33e05214f8f553d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
memory/2336-134-0x0000000000000000-mapping.dmp

Download
memory/2684-123-0x000000000044C24E-mapping.dmp

Download
memory/2684-126-0x0000000000430000-0x0000000000484000-memory.dmp

Filesize
336KB

Download
memory/2684-141-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/2684-131-0x0000000000430000-0x0000000000432000-memory.dmp

Filesize
8KB

Download
memory/2684-133-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/2684-135-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/2684-136-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3472-139-0x0000000000000000-mapping.dmp

Download
memory/3900-143-0x0000000000000000-mapping.dmp

Download
memory/3944-114-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/3944-117-0x0000000007440000-0x0000000007C1F000-memory.dmp

Filesize
7.9MB

Download
memory/3944-116-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/3944-118-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/3964-140-0x0000000000000000-mapping.dmp

Download
memory/4052-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads