Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 02:38
Static task
static1
Behavioral task
behavioral1
Sample
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe
Resource
win10v2004-20220414-en
General
-
Target
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe
-
Size
364KB
-
MD5
9af2b3841221ccb778c03f8535853d59
-
SHA1
80fac73976ca4b7978d7ec8cb9a6962347cea18a
-
SHA256
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd
-
SHA512
ae55d19c3cec653074dbf46ff313ee55d68297c6b6fd2ef9d24730cf7094f59a62621e6a59c5ca6ffce071bd57fd61d95ab32580d01b6a1c439b6cb7ce59cc04
Malware Config
Signatures
-
HiveRAT Payload 15 IoCs
Processes:
resource yara_rule behavioral1/memory/820-63-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-64-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-65-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-66-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-67-0x000000000044CA7E-mapping.dmp family_hiverat behavioral1/memory/820-69-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-71-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-73-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-75-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-74-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-76-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-80-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-83-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-84-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/820-85-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Avast Essentialsq = "C:\\Users\\Admin\\AppData\\Roaming\\Avastr.exe" WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exedescription pid process target process PID 1564 set thread context of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1896 1564 WerFault.exe 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 820 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe Token: SeDebugPrivilege 820 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exeInstallUtil.exeexplorer.exedescription pid process target process PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 1564 wrote to memory of 820 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe InstallUtil.exe PID 820 wrote to memory of 1760 820 InstallUtil.exe explorer.exe PID 820 wrote to memory of 1760 820 InstallUtil.exe explorer.exe PID 820 wrote to memory of 1760 820 InstallUtil.exe explorer.exe PID 820 wrote to memory of 1760 820 InstallUtil.exe explorer.exe PID 1888 wrote to memory of 1924 1888 explorer.exe WScript.exe PID 1888 wrote to memory of 1924 1888 explorer.exe WScript.exe PID 1888 wrote to memory of 1924 1888 explorer.exe WScript.exe PID 1564 wrote to memory of 1896 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe WerFault.exe PID 1564 wrote to memory of 1896 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe WerFault.exe PID 1564 wrote to memory of 1896 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe WerFault.exe PID 1564 wrote to memory of 1896 1564 1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe"C:\Users\Admin\AppData\Local\Temp\1818a00c19f6e851246823dc4bc7fbf7bfdfb1ad53dab20b572641770f3fc1bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Execution.vbs3⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 17802⤵
- Program crash
PID:1896
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution.vbs"2⤵
- Adds Run key to start application
PID:1924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
522B
MD503fb16e9adeaba44143302d5f1059ab0
SHA142270b26cffd20e44bdf6b985ab52600b64a3fca
SHA256058ef8fa720792e6e130fd1a80752bb06e695d3c4fc8fc75d0f27deb5049e761
SHA5128dba4f8e94780a926200dce2d047cacd086f2bd1550bf0070583752d38828cb48dcfb45bb944095dca753ffb3d20570ee02df12d083a259f0a88973a6b4a6c21