Analysis
-
max time kernel
150s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:34
General
-
Target
Receipt For Shipment - 202008DHL_pdf.exe
-
Size
439KB
-
MD5
ddb7bbd558fcd125902849965c808037
-
SHA1
1709dd13064045c763fef647324ea18f6548a93e
-
SHA256
01a1c9bf023cdb265ad67a2a45db38fe25e9a23fd4bdb75a9e8f12c7b79eec8f
-
SHA512
480450fc131ac2a97be46d22f47022dc23b9aff807825be4e333f5638f0a86c20a24f86af9e72f06af4d33456316b862191c164fcb01920c3c97b0577dbf757e
Score
10/10
Malware Config
Signatures
-
HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
-
HiveRAT Payload 15 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Receipt For Shipment - 202008DHL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Receipt For Shipment - 202008DHL_pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Receipt For Shipment - 202008DHL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Receipt For Shipment - 202008DHL_pdf.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
8KB
-
Filesize
456KB
-
Filesize
432KB