hiverat | 1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46 | Triage

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-05-2022 04:10

Sharing

Report Analysis Logs

General

Target

hive.exe
Size

440KB
MD5

84749489341fb7f968fc940eb0751d23
SHA1

89609f93cdd419af9fa82a9734b1bffc63563068
SHA256

1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46
SHA512

cabc5654113150b98f3a7fe3f9c79ed50dd90285d310cb4c60b6eb01ba48a1c411d773254d5dca4424c70a9e3487850e5e443d4fac422b4b99a95663655e68f3

Score

10^/10

hiverat rat stealer

Malware Config

Signatures

HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
rat stealer hiverat

HiveRAT Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1616-130-0x0000000000BD0000-0x0000000000C4C000-memory.dmp	family_hiverat

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

hive.exe

pid process

1616 hive.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hive.exe

description pid process

Token: SeDebugPrivilege 1616 hive.exe

C:\Users\Admin\AppData\Local\Temp\hive.exe
"C:\Users\Admin\AppData\Local\Temp\hive.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-130-0x0000000000BD0000-0x0000000000C4C000-memory.dmp

Filesize
496KB

Download
memory/1616-131-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Filesize
584KB

Download
memory/1616-132-0x0000000004FC0000-0x000000000505C000-memory.dmp

Filesize
624KB

Download
memory/1616-133-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download