Analysis
-
max time kernel
126s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
29-03-2022 18:19
General
-
Target
983307d0b15ee7e2bf5551873f5dc7dd486951263de813c7beed55ab726ef91c.exe
-
Size
355KB
-
MD5
2f0e24e82f7c70b3c698af44d4e1985d
-
SHA1
d82af75bed79db528eed3520af0b79bb9476deec
-
SHA256
983307d0b15ee7e2bf5551873f5dc7dd486951263de813c7beed55ab726ef91c
-
SHA512
d1e17b54773b8abbd6a1c713f25c96436643b7059c2fc1f3bd2976daffbaca719df066279659e7340bedf57fa29a626da753f937bf3022c7f9380547396bc1cb
Score
10/10
Malware Config
Signatures
-
HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
-
HiveRAT Payload 10 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\983307d0b15ee7e2bf5551873f5dc7dd486951263de813c7beed55ab726ef91c.exe"C:\Users\Admin\AppData\Local\Temp\983307d0b15ee7e2bf5551873f5dc7dd486951263de813c7beed55ab726ef91c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 7003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4568 -ip 45681⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
136KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB