hiverat | 1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46 | Triage

Analysis

max time kernel
154s
max time network
154s
platform
windows7_x64
resource
win7-en-20211208
submitted
30-01-2022 12:46

Sharing

Report Analysis Logs

General

Target

84749489341fb7f968fc940eb0751d23.exe
Size

440KB
MD5

84749489341fb7f968fc940eb0751d23
SHA1

89609f93cdd419af9fa82a9734b1bffc63563068
SHA256

1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46
SHA512

cabc5654113150b98f3a7fe3f9c79ed50dd90285d310cb4c60b6eb01ba48a1c411d773254d5dca4424c70a9e3487850e5e443d4fac422b4b99a95663655e68f3

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1536-54-0x0000000000D70000-0x0000000000DEC000-memory.dmp	family_hiverat

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

84749489341fb7f968fc940eb0751d23.exe

pid process

1536 84749489341fb7f968fc940eb0751d23.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

84749489341fb7f968fc940eb0751d23.exe

description pid process

Token: SeDebugPrivilege 1536 84749489341fb7f968fc940eb0751d23.exe

C:\Users\Admin\AppData\Local\Temp\84749489341fb7f968fc940eb0751d23.exe
"C:\Users\Admin\AppData\Local\Temp\84749489341fb7f968fc940eb0751d23.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x0000000000D70000-0x0000000000DEC000-memory.dmp

Filesize
496KB

Download
memory/1536-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1536-56-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download