hiverat | 9dd4a95031cc128d8ca15aa0daba60ae2f897e56483eb70bc7859cebcdd60cda

General

Target

Console Sniffer Cracked/ConsoleSniffer v4.1 installer.exe
Size

7.9MB
MD5

61d8ca5f3ec331a08c9032840b99eb5b
SHA1

dc73d785c3e899a58a5616239e89d3fd3d49bb93
SHA256

a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811
SHA512

f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2684-123-0x000000000044C24E-mapping.dmp	family_hiverat
behavioral2/memory/2684-126-0x0000000000430000-0x0000000000484000-memory.dmp	family_hiverat

Executes dropped EXE 2 IoCs

pid	Process
4052	File.exe
2684	svhost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk	ConsoleSniffer v4.1 installer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 2684	3944	ConsoleSniffer v4.1 installer.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3900	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3944	ConsoleSniffer v4.1 installer.exe
3944	ConsoleSniffer v4.1 installer.exe
3944	ConsoleSniffer v4.1 installer.exe
3944	ConsoleSniffer v4.1 installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	ConsoleSniffer v4.1 installer.exe
Token: SeDebugPrivilege	2684	svhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4052	3944	ConsoleSniffer v4.1 installer.exe	76
PID 3944 wrote to memory of 4052	3944	ConsoleSniffer v4.1 installer.exe	76
PID 3944 wrote to memory of 4052	3944	ConsoleSniffer v4.1 installer.exe	76
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2684	3944	ConsoleSniffer v4.1 installer.exe	77
PID 3944 wrote to memory of 2336	3944	ConsoleSniffer v4.1 installer.exe	78
PID 3944 wrote to memory of 2336	3944	ConsoleSniffer v4.1 installer.exe	78
PID 3944 wrote to memory of 2336	3944	ConsoleSniffer v4.1 installer.exe	78
PID 3944 wrote to memory of 3472	3944	ConsoleSniffer v4.1 installer.exe	80
PID 3944 wrote to memory of 3472	3944	ConsoleSniffer v4.1 installer.exe	80
PID 3944 wrote to memory of 3472	3944	ConsoleSniffer v4.1 installer.exe	80
PID 3944 wrote to memory of 3964	3944	ConsoleSniffer v4.1 installer.exe	82
PID 3944 wrote to memory of 3964	3944	ConsoleSniffer v4.1 installer.exe	82
PID 3944 wrote to memory of 3964	3944	ConsoleSniffer v4.1 installer.exe	82
PID 3964 wrote to memory of 3900	3964	cmd.exe	84
PID 3964 wrote to memory of 3900	3964	cmd.exe	84
PID 3964 wrote to memory of 3900	3964	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\Console Sniffer Cracked\ConsoleSniffer v4.1 installer.exe
"C:\Users\Admin\AppData\Local\Temp\Console Sniffer Cracked\ConsoleSniffer v4.1 installer.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Console Sniffer Cracked/ConsoleSniffer v4.1 installer.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:3900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-126-0x0000000000430000-0x0000000000484000-memory.dmp

Filesize
336KB

Download
memory/2684-141-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/2684-131-0x0000000000430000-0x0000000000432000-memory.dmp

Filesize
8KB

Download
memory/2684-133-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/2684-135-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/2684-136-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3944-114-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/3944-117-0x0000000007440000-0x0000000007C1F000-memory.dmp

Filesize
7.9MB

Download
memory/3944-116-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/3944-118-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing