Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 09:37
Static task
static1
Behavioral task
behavioral1
Sample
d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe
-
Size
303KB
-
MD5
44738f6a68e89ead0109704208059b64
-
SHA1
18119563ec62b034e81d9a315dfbc17bf5e682c8
-
SHA256
d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d
-
SHA512
59c78756389231e13f138e159464e2a859b16e4558af06f132a394fa162c4cb5b04ff94fd77d4ebf08623cbec9c7f16b1583df842b5e37729a4cceb0d7715eb2
Malware Config
Signatures
-
HiveRAT Payload 10 IoCs
resource yara_rule behavioral2/memory/2304-136-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-138-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-141-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-143-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-142-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-140-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-147-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-150-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-151-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral2/memory/2304-152-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysWOW64.exe d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysWOW64.exe d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1984 set thread context of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2304 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe Token: SeDebugPrivilege 2304 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77 PID 1984 wrote to memory of 2304 1984 d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe"C:\Users\Admin\AppData\Local\Temp\d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe"C:\Users\Admin\AppData\Local\Temp\d44651217b87d290e2be6c004e8732817bf1d3d61043a93b25e1130ab7a56c7d.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2304
-