hiverat | a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811

Analysis

max time kernel
141s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
20-06-2021 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ConsoleSniffer v4.1 installer.exe
Size

7.9MB
MD5

61d8ca5f3ec331a08c9032840b99eb5b
SHA1

dc73d785c3e899a58a5616239e89d3fd3d49bb93
SHA256

a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811
SHA512

f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-70-0x000000000044C24E-mapping.dmp	family_hiverat
behavioral1/memory/1736-75-0x0000000000090000-0x00000000000E4000-memory.dmp	family_hiverat
behavioral1/memory/1736-79-0x0000000000090000-0x00000000000E4000-memory.dmp	family_hiverat

Executes dropped EXE 2 IoCs

Processes:

File.exesvhost.exe

pid process

1768 File.exe
1736 svhost.exe

pid	process
1768	File.exe
1736	svhost.exe

Drops startup file 1 IoCs

Processes:

ConsoleSniffer v4.1 installer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk	ConsoleSniffer v4.1 installer.exe

Loads dropped DLL 8 IoCs

Processes:

ConsoleSniffer v4.1 installer.exeFile.exesvhost.exe

pid	process
2000	ConsoleSniffer v4.1 installer.exe
2000	ConsoleSniffer v4.1 installer.exe
1768	File.exe
1768	File.exe
1736	svhost.exe
1736	svhost.exe
2000	ConsoleSniffer v4.1 installer.exe
2000	ConsoleSniffer v4.1 installer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ConsoleSniffer v4.1 installer.exe

description pid process target process

PID 2000 set thread context of 1736 2000 ConsoleSniffer v4.1 installer.exe svhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1816 timeout.exe
NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe

description	pid	process	target process
PID 2000 set thread context of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe

pid	process
1816	timeout.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ConsoleSniffer v4.1 installer.exe

pid	process
2000	ConsoleSniffer v4.1 installer.exe
2000	ConsoleSniffer v4.1 installer.exe
2000	ConsoleSniffer v4.1 installer.exe
2000	ConsoleSniffer v4.1 installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svhost.exe

pid process

1736 svhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ConsoleSniffer v4.1 installer.exesvhost.exe

description pid process

Token: SeDebugPrivilege 2000 ConsoleSniffer v4.1 installer.exe
Token: SeDebugPrivilege 1736 svhost.exe

pid	process
1736	svhost.exe

description	pid	process
Token: SeDebugPrivilege	2000	ConsoleSniffer v4.1 installer.exe
Token: SeDebugPrivilege	1736	svhost.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

ConsoleSniffer v4.1 installer.execmd.exe

description	pid	process	target process
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1768	2000	ConsoleSniffer v4.1 installer.exe	File.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 1736	2000	ConsoleSniffer v4.1 installer.exe	svhost.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 332	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 620	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 2000 wrote to memory of 1672	2000	ConsoleSniffer v4.1 installer.exe	cmd.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe
PID 1672 wrote to memory of 1816	1672	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\ConsoleSniffer v4.1 installer.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleSniffer v4.1 installer.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/ConsoleSniffer v4.1 installer.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe

MD5
61d8ca5f3ec331a08c9032840b99eb5b

SHA1
dc73d785c3e899a58a5616239e89d3fd3d49bb93

SHA256
a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811

SHA512
f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat

MD5
bfcbf382f036462e63f307ca4ae280c7

SHA1
ffe98d15fa5ea205220d6bc105e317253a6ea003

SHA256
2c3dd84c3ce3e529117e611d8caf4fc7f5a902840350f4ca524c251a2152c727

SHA512
1b912652cc989541b396df5fd6bf207a4cf4ed891dc6e3223b8d0497c19a2589cb644c4c96ca01d882a7643f240c566966d84e46d77e9ad33e05214f8f553d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
\Users\Admin\AppData\Local\Temp\File.exe

MD5
9e24d7787acbb9ab91536fc82ec84c6c

SHA1
603d7fd0ad43edcdf369dd35fe4641cdf523f31d

SHA256
6b84979505ecf68d5feefbc4c47b4770e5abc1fb18e1ce54503e05fc637812b3

SHA512
07a4f5341c75d734afd07492a06fe6b8d2935928c07138edd3ae65e49a2353be1174b9247d31c4145fe6a766a1e5071a20732ecf6fcfc8d017088a918b370dc7

Download Submit
\Users\Admin\AppData\Local\Temp\FolderN\name.exe

MD5
61d8ca5f3ec331a08c9032840b99eb5b

SHA1
dc73d785c3e899a58a5616239e89d3fd3d49bb93

SHA256
a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811

SHA512
f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Download Submit
\Users\Admin\AppData\Local\Temp\FolderN\name.exe

MD5
61d8ca5f3ec331a08c9032840b99eb5b

SHA1
dc73d785c3e899a58a5616239e89d3fd3d49bb93

SHA256
a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811

SHA512
f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Download Submit
\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
\Users\Admin\AppData\Local\Temp\svhost.exe

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
memory/332-86-0x0000000000000000-mapping.dmp

Download
memory/620-91-0x0000000000000000-mapping.dmp

Download
memory/1672-94-0x0000000000000000-mapping.dmp

Download
memory/1736-92-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1736-84-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/1736-79-0x0000000000090000-0x00000000000E4000-memory.dmp

Filesize
336KB

Download
memory/1736-70-0x000000000044C24E-mapping.dmp

Download
memory/1736-75-0x0000000000090000-0x00000000000E4000-memory.dmp

Filesize
336KB

Download
memory/1768-65-0x0000000000000000-mapping.dmp

Download
memory/1816-97-0x0000000000000000-mapping.dmp

Download
memory/2000-59-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/2000-63-0x00000000056F0000-0x0000000005ECF000-memory.dmp

Filesize
7.9MB

Download
memory/2000-62-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/2000-60-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download