hiverat | a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811

General

Target

ConsoleSniffer v4.1 installer.exe
Size

7.9MB
MD5

61d8ca5f3ec331a08c9032840b99eb5b
SHA1

dc73d785c3e899a58a5616239e89d3fd3d49bb93
SHA256

a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811
SHA512

f8150b1be4559c350467bfb941e6fee1d3dbcd97111e92d55edc047f9fde6b8bc7f63cdbd595f6378e781cadaa69eeeda38d440f02792a48562523e7d97b7ebb

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 4 IoCs

resource	yara_rule
behavioral2/memory/3308-122-0x0000000000400000-0x0000000000454000-memory.dmp	family_hiverat
behavioral2/memory/3308-123-0x000000000044C24E-mapping.dmp	family_hiverat
behavioral2/memory/3308-126-0x0000000000400000-0x0000000000454000-memory.dmp	family_hiverat
behavioral2/memory/3308-132-0x0000000000400000-0x0000000000454000-memory.dmp	family_hiverat

Executes dropped EXE 2 IoCs

pid	Process
3368	File.exe
3308	svhost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk	ConsoleSniffer v4.1 installer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 3308	3932	ConsoleSniffer v4.1 installer.exe	76

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3968	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	ConsoleSniffer v4.1 installer.exe
3932	ConsoleSniffer v4.1 installer.exe
3932	ConsoleSniffer v4.1 installer.exe
3932	ConsoleSniffer v4.1 installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3308	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	ConsoleSniffer v4.1 installer.exe
Token: SeDebugPrivilege	3308	svhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3368	3932	ConsoleSniffer v4.1 installer.exe	75
PID 3932 wrote to memory of 3368	3932	ConsoleSniffer v4.1 installer.exe	75
PID 3932 wrote to memory of 3368	3932	ConsoleSniffer v4.1 installer.exe	75
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 3308	3932	ConsoleSniffer v4.1 installer.exe	76
PID 3932 wrote to memory of 2836	3932	ConsoleSniffer v4.1 installer.exe	77
PID 3932 wrote to memory of 2836	3932	ConsoleSniffer v4.1 installer.exe	77
PID 3932 wrote to memory of 2836	3932	ConsoleSniffer v4.1 installer.exe	77
PID 3932 wrote to memory of 4008	3932	ConsoleSniffer v4.1 installer.exe	79
PID 3932 wrote to memory of 4008	3932	ConsoleSniffer v4.1 installer.exe	79
PID 3932 wrote to memory of 4008	3932	ConsoleSniffer v4.1 installer.exe	79
PID 3932 wrote to memory of 2100	3932	ConsoleSniffer v4.1 installer.exe	81
PID 3932 wrote to memory of 2100	3932	ConsoleSniffer v4.1 installer.exe	81
PID 3932 wrote to memory of 2100	3932	ConsoleSniffer v4.1 installer.exe	81
PID 2100 wrote to memory of 3968	2100	cmd.exe	83
PID 2100 wrote to memory of 3968	2100	cmd.exe	83
PID 2100 wrote to memory of 3968	2100	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\ConsoleSniffer v4.1 installer.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleSniffer v4.1 installer.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/ConsoleSniffer v4.1 installer.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:2836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:3968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3308-133-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/3308-122-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3308-126-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3308-128-0x0000000005D00000-0x0000000005D01000-memory.dmp

Filesize
4KB

Download
memory/3308-129-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/3308-131-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/3308-132-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3932-114-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/3932-117-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download
memory/3932-118-0x0000000006A60000-0x000000000723F000-memory.dmp

Filesize
7.9MB

Download
memory/3932-116-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing