Analysis
-
max time kernel
155s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2022 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Slip_063b22.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
General
-
Target
Slip_063b22.exe
-
Size
2.5MB
-
MD5
9fc63544f95d6597481b2ad968d956bd
-
SHA1
99a6b796833db909cff3d3d8678652216c9b9bd4
-
SHA256
0dedc8d99e368addcf1950fd4656b8c95800210b2b5e152880634aaa37c27c81
-
SHA512
a64d99e979e2e12ebe5a3fe03234d4b4f60c089922ead4906c3cd61eb4be04e485d0959e34bc237add4c12dfbaf4d946b1953ce0d3539f8fc61902601bd06713
-
SSDEEP
49152:+w80cTsjkWaFsWTfnmxsD8+sjYlaMx7WB/udhrWzBVb:D8sjkWkmSiYlnx6Fud9Wz
Malware Config
Signatures
-
HiveRAT payload 16 IoCs
resource yara_rule behavioral2/memory/392-136-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-137-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-138-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-139-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-140-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-141-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-142-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-143-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-144-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-145-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-149-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-152-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-153-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-154-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-162-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat behavioral2/memory/392-170-0x0000000000400000-0x000000000081C000-memory.dmp family_hiverat -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KBWJC.com.url Slip_063b22.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe 392 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1072 set thread context of 392 1072 Slip_063b22.exe 84 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe 1072 Slip_063b22.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 392 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 392 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 392 svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84 PID 1072 wrote to memory of 392 1072 Slip_063b22.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Slip_063b22.exe"C:\Users\Admin\AppData\Local\Temp\Slip_063b22.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:392
-