hiverat | 1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46 | Triage

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-05-2022 11:53

Sharing

Report Analysis Logs

General

Target

hive.exe
Size

440KB
MD5

84749489341fb7f968fc940eb0751d23
SHA1

89609f93cdd419af9fa82a9734b1bffc63563068
SHA256

1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46
SHA512

cabc5654113150b98f3a7fe3f9c79ed50dd90285d310cb4c60b6eb01ba48a1c411d773254d5dca4424c70a9e3487850e5e443d4fac422b4b99a95663655e68f3

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4344-130-0x0000000000CD0000-0x0000000000D4C000-memory.dmp	family_hiverat

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

hive.exe

pid process

4344 hive.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hive.exe

description pid process

Token: SeDebugPrivilege 4344 hive.exe

C:\Users\Admin\AppData\Local\Temp\hive.exe
"C:\Users\Admin\AppData\Local\Temp\hive.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-130-0x0000000000CD0000-0x0000000000D4C000-memory.dmp

Filesize
496KB

Download
memory/4344-131-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/4344-132-0x0000000005AE0000-0x0000000005B7C000-memory.dmp

Filesize
624KB

Download
memory/4344-133-0x0000000006850000-0x0000000006DF4000-memory.dmp

Filesize
5.6MB

Download