Analysis
- user interaction
yes - max time kernel
103s - max time network
78s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nigger.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Nigger.exe
- Size 29.3MB
- Sample260925-vfxb8a1flg
- SHA256 965aca0171d69f7b37314e2e6ce4eb7045ead32746217ce9837e1119ef6078bb
- MD5 407325cf5c91b118f2c552a54d65eb36
- SHA1 4e257154faa784fdba26ca5f0cc064e6f9d107db
- SHA512 2a4d3415365aa6e30cc1630144fe24411dd0318a3bd2e69a16da432da8e9a602249b61e86bd078e24cc084cfcf5651a1d26741f58582e8092c3a085f0b3347d4
- SSDEEP 393216:bSvahpZCdeKs1QSPAmkZs00GaJT76mhfPAmkgML1:hQZsfJX6QfQZL
- TLSH T1BC67D042F7848EA3C089977985638797D332FC4ABB1317A732987D257E93BD05E26381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2556 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Nigger.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Nigger.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe 2480 Nigger.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 Nigger.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2480 Nigger.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2556 2480 Nigger.exe 89 PID 2556 wrote to memory of 4776 2556 cmd.exe 91 PID 2556 wrote to memory of 3432 2556 cmd.exe 92 PID 2556 wrote to memory of 4332 2556 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nigger.exe"C:\Users\Admin\AppData\Local\Temp\Nigger.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Nigger.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Nigger.exe" MD53⤵PID:4776
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3432
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4332
-
-