6a3b7dd0e6d57a45d7b7a4d00fe02ac8196ffc026e61b3a593067137af60ee48

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_82d33a7604921aa4fa504e9a2b6541a8_icedid_njrat_stealc.exe
Size 6.5MB
Sample260425-tathpsez8k
SHA256 6a3b7dd0e6d57a45d7b7a4d00fe02ac8196ffc026e61b3a593067137af60ee48
MD5 82d33a7604921aa4fa504e9a2b6541a8
SHA1 0141c29dc0bdb0b69a77819c1b9ee23fcb3ec663
SHA512 bd5fa1259f99b7780965ae6f8eacd3125dedda421e2d85ddda5aa015672b5009064c8f07661279e0893253e058dcbe0e629c260c352c324821a0e8657e3802b2
SSDEEP 196608:M+hBtOkS9ByQyVG/uzGNVyAl3K8fCGnbP3JzATC4f:btO/NSG/lVrl3KExL3JzATzf
TLSH
T1EA66012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4064	powershell.exe
4200	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	2026-04-25_82d33a7604921aa4fa504e9a2b6541a8_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1272	PeerService.exe
4584	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
4572	tasklist.exe
2056	tasklist.exe
3740	tasklist.exe
3472	tasklist.exe
1200	tasklist.exe
3492	tasklist.exe
2072	tasklist.exe
3028	tasklist.exe
3240	tasklist.exe
1180	tasklist.exe
2104	tasklist.exe
1008	tasklist.exe
772	tasklist.exe
3548	tasklist.exe
1840	tasklist.exe
1512	tasklist.exe
728	tasklist.exe
1880	tasklist.exe
4568	tasklist.exe
4520	tasklist.exe
4308	tasklist.exe
4296	tasklist.exe
4368	tasklist.exe
3848	tasklist.exe
4612	tasklist.exe
4672	tasklist.exe
3228	tasklist.exe
4336	tasklist.exe
3184	tasklist.exe
4612	tasklist.exe
1684	tasklist.exe
2104	tasklist.exe
2812	tasklist.exe
2416	tasklist.exe
1860	tasklist.exe
4256	tasklist.exe
3488	tasklist.exe
4580	tasklist.exe
4144	tasklist.exe
2592	tasklist.exe
3780	tasklist.exe
2308	tasklist.exe
3116	tasklist.exe
4436	tasklist.exe
4788	tasklist.exe
4048	tasklist.exe
4672	tasklist.exe
4184	tasklist.exe
2992	tasklist.exe
2092	tasklist.exe
404	tasklist.exe
4820	tasklist.exe
3620	tasklist.exe
1756	tasklist.exe
3000	tasklist.exe
4516	tasklist.exe
4164	tasklist.exe
4296	tasklist.exe
4340	tasklist.exe
3536	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
728	timeout.exe
2872	timeout.exe
1872	timeout.exe
3336	timeout.exe
4336	timeout.exe
4204	timeout.exe
3852	timeout.exe
3340	timeout.exe
1552	timeout.exe
4772	timeout.exe
1532	timeout.exe
2464	timeout.exe
1848	timeout.exe
1544	timeout.exe
2612	timeout.exe
1088	timeout.exe
4768	timeout.exe
4064	timeout.exe
4848	timeout.exe
740	timeout.exe
3912	timeout.exe
2872	timeout.exe
3872	timeout.exe
3116	timeout.exe
1228	timeout.exe
3504	timeout.exe
972	timeout.exe
4416	timeout.exe
4148	timeout.exe
1860	timeout.exe
1704	timeout.exe
824	timeout.exe
4800	timeout.exe
2856	timeout.exe
4812	timeout.exe
3432	timeout.exe
3840	timeout.exe
3332	timeout.exe
2564	timeout.exe
1184	timeout.exe
788	timeout.exe
4064	timeout.exe
3212	timeout.exe
4684	timeout.exe
2576	timeout.exe
836	timeout.exe
692	timeout.exe
4368	timeout.exe
2392	timeout.exe
1184	timeout.exe
4416	timeout.exe
3808	timeout.exe
1700	timeout.exe
2784	timeout.exe
2636	timeout.exe
212	timeout.exe
4960	timeout.exe
3236	timeout.exe
1008	timeout.exe
5100	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4064	powershell.exe
4064	powershell.exe
4200	powershell.exe
4200	powershell.exe
4200	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3492	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	3184	tasklist.exe
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	1008	tasklist.exe
Token: SeDebugPrivilege	3116	tasklist.exe
Token: SeDebugPrivilege	3740	tasklist.exe
Token: SeDebugPrivilege	4368	tasklist.exe
Token: SeDebugPrivilege	772	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	4336	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	2056	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	3848	tasklist.exe
Token: SeDebugPrivilege	2992	tasklist.exe
Token: SeDebugPrivilege	2072	tasklist.exe
Token: SeDebugPrivilege	4672	tasklist.exe
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	4820	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	3240	tasklist.exe
Token: SeDebugPrivilege	4184	tasklist.exe
Token: SeDebugPrivilege	3000	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeDebugPrivilege	1180	tasklist.exe
Token: SeDebugPrivilege	3472	tasklist.exe
Token: SeDebugPrivilege	2104	tasklist.exe
Token: SeDebugPrivilege	1880	tasklist.exe
Token: SeDebugPrivilege	4672	tasklist.exe
Token: SeDebugPrivilege	1840	tasklist.exe
Token: SeDebugPrivilege	4436	tasklist.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeDebugPrivilege	3488	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	1512	tasklist.exe
Token: SeDebugPrivilege	4256	tasklist.exe
Token: SeDebugPrivilege	4144	tasklist.exe
Token: SeDebugPrivilege	2104	tasklist.exe
Token: SeDebugPrivilege	404	tasklist.exe
Token: SeDebugPrivilege	4788	tasklist.exe
Token: SeDebugPrivilege	2592	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	4340	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeDebugPrivilege	3780	tasklist.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	728	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2432	4632	2026-04-25_82d33a7604921aa4fa504e9a2b6541a8_icedid_njrat_stealc.exe	84
PID 2432 wrote to memory of 3288	2432	cmd.exe	86
PID 4632 wrote to memory of 1272	4632	2026-04-25_82d33a7604921aa4fa504e9a2b6541a8_icedid_njrat_stealc.exe	87
PID 1272 wrote to memory of 4284	1272	PeerService.exe	89
PID 1272 wrote to memory of 2468	1272	PeerService.exe	92
PID 4284 wrote to memory of 4064	4284	cmd.exe	95
PID 2468 wrote to memory of 3492	2468	cmd.exe	96
PID 2468 wrote to memory of 2600	2468	cmd.exe	97
PID 4584 wrote to memory of 4008	4584	PeerService.exe	99
PID 4584 wrote to memory of 4724	4584	PeerService.exe	100
PID 4724 wrote to memory of 2812	4724	cmd.exe	104
PID 4724 wrote to memory of 4588	4724	cmd.exe	105
PID 4008 wrote to memory of 4200	4008	cmd.exe	106
PID 4724 wrote to memory of 3332	4724	cmd.exe	107
PID 2468 wrote to memory of 740	2468	cmd.exe	108
PID 2468 wrote to memory of 3184	2468	cmd.exe	109
PID 2468 wrote to memory of 1624	2468	cmd.exe	110
PID 4724 wrote to memory of 2308	4724	cmd.exe	111
PID 4724 wrote to memory of 1692	4724	cmd.exe	112
PID 2468 wrote to memory of 2392	2468	cmd.exe	113
PID 4724 wrote to memory of 4684	4724	cmd.exe	114
PID 2468 wrote to memory of 1008	2468	cmd.exe	115
PID 2468 wrote to memory of 3560	2468	cmd.exe	116
PID 4724 wrote to memory of 3116	4724	cmd.exe	117
PID 4724 wrote to memory of 1780	4724	cmd.exe	118
PID 2468 wrote to memory of 3340	2468	cmd.exe	119
PID 4724 wrote to memory of 2576	4724	cmd.exe	120
PID 4724 wrote to memory of 3740	4724	cmd.exe	121
PID 4724 wrote to memory of 1696	4724	cmd.exe	122
PID 2468 wrote to memory of 4368	2468	cmd.exe	123
PID 2468 wrote to memory of 1212	2468	cmd.exe	124
PID 4724 wrote to memory of 4812	4724	cmd.exe	125
PID 2468 wrote to memory of 836	2468	cmd.exe	126
PID 2468 wrote to memory of 772	2468	cmd.exe	127
PID 2468 wrote to memory of 4384	2468	cmd.exe	128
PID 4724 wrote to memory of 4612	4724	cmd.exe	129
PID 4724 wrote to memory of 4564	4724	cmd.exe	130
PID 4724 wrote to memory of 728	4724	cmd.exe	131
PID 2468 wrote to memory of 3912	2468	cmd.exe	132
PID 2468 wrote to memory of 1756	2468	cmd.exe	133
PID 2468 wrote to memory of 1100	2468	cmd.exe	134
PID 4724 wrote to memory of 4336	4724	cmd.exe	135
PID 4724 wrote to memory of 520	4724	cmd.exe	136
PID 2468 wrote to memory of 1184	2468	cmd.exe	137
PID 4724 wrote to memory of 2872	4724	cmd.exe	138
PID 2468 wrote to memory of 4572	2468	cmd.exe	140
PID 2468 wrote to memory of 4052	2468	cmd.exe	141
PID 4724 wrote to memory of 2056	4724	cmd.exe	142
PID 4724 wrote to memory of 2164	4724	cmd.exe	143
PID 2468 wrote to memory of 4416	2468	cmd.exe	144
PID 4724 wrote to memory of 212	4724	cmd.exe	145
PID 2468 wrote to memory of 2416	2468	cmd.exe	146
PID 2468 wrote to memory of 1496	2468	cmd.exe	147
PID 4724 wrote to memory of 3848	4724	cmd.exe	148
PID 4724 wrote to memory of 1584	4724	cmd.exe	149
PID 2468 wrote to memory of 1552	2468	cmd.exe	150
PID 4724 wrote to memory of 1872	4724	cmd.exe	151
PID 4724 wrote to memory of 2992	4724	cmd.exe	152
PID 4724 wrote to memory of 1660	4724	cmd.exe	153
PID 2468 wrote to memory of 2072	2468	cmd.exe	154
PID 2468 wrote to memory of 752	2468	cmd.exe	155
PID 4724 wrote to memory of 4772	4724	cmd.exe	156
PID 2468 wrote to memory of 692	2468	cmd.exe	157
PID 4724 wrote to memory of 4672	4724	cmd.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-25_82d33a7604921aa4fa504e9a2b6541a8_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_82d33a7604921aa4fa504e9a2b6541a8_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3492
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1624
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1008
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3560
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4368
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1212
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1184
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4572
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4052
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:752
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4200
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3472
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4672
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3812
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1840
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4580
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3228
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1052
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4768
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2992
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1872
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2636
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4388
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1200
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2080
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4832
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4148

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1780
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2576
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1696
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:728
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2164
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1584
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4772
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:940
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4960
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1704
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1956
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:628
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2612
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2000
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:768
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4216
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4848
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae
MD5 555e68af1b8e33f84346bf2335e6191a
SHA1 fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e
SHA512 6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e
TLSH
T10C112223F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y0bidron.03z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y0bidron.03z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.8MB
SHA256 d2962be22990ffa77e4fafa2b21dcbac060648e3426a1172c58591d8edb97bb2
MD5 33b9f935bbf6c3d02ae7b6ca9c50118d
SHA1 20032104eedfd7cbe59de248e450a1ee3ae85cf7
SHA512 98b4c9296f37769668d6e8c6125dea5f51a1648bf6e41a3e9193d190417880aba6b97d5b67a4fb052a8e5642a6dc6ee2ddb10bd224b24c952af990db7b586ba5
SSDEEP 196608:M+hBtOkS9ByQyVG/uzGNVyAl3K8fCGnbP3JzATC4HByQyVG/uzGN0:btO/NSG/lVrl3KExL3JzATzhNSG/l0
TLSH
T1A086022BB26901E8D1BFD17CC9165907EBB2780543A0A7DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4064-27-0x0000020BC16D0000-0x0000020BC16F2000-memory.dmp

Download

memory/4064-39-0x0000020BA8E30000-0x0000020BA8E3C000-memory.dmp

Download

memory/4200-43-0x0000024F76290000-0x0000024F7629C000-memory.dmp

Download