5066c86d55094133aef0dc2e3e2494ec6c4d11b58e24388457cf3f737897bb24

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_b4e884ac2f5c2c7a53d71178190610d9_icedid_njrat_stealc.exe
Size 6.6MB
Sample260504-mwp9vahs4s
SHA256 5066c86d55094133aef0dc2e3e2494ec6c4d11b58e24388457cf3f737897bb24
MD5 b4e884ac2f5c2c7a53d71178190610d9
SHA1 db38507883abab6783aa0a26107cd6a570a41fc5
SHA512 fc7ca270741aa39f9e0a293d426e50927f37ab45d773b8e4d18160c701bed3b810f58e79911c580697ef17a850b1596ff0cc74db0c90533451dce70681180c0f
SSDEEP 196608:s+hx9ekESByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CX:L9egNSG/lVrl3KExL3JzATzCX
TLSH
T15566012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
5520	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3744	PeerService.exe
4124	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
4308	tasklist.exe
1468	tasklist.exe
740	tasklist.exe
1784	tasklist.exe
4904	tasklist.exe
916	tasklist.exe
4808	tasklist.exe
4652	tasklist.exe
5884	tasklist.exe
1772	tasklist.exe
1448	tasklist.exe
920	tasklist.exe
4436	tasklist.exe
2232	tasklist.exe
5444	tasklist.exe
2176	tasklist.exe
468	tasklist.exe
1436	tasklist.exe
1472	tasklist.exe
2372	tasklist.exe
2628	tasklist.exe
2356	tasklist.exe
3532	tasklist.exe
1560	tasklist.exe
2328	tasklist.exe
2972	tasklist.exe
3644	tasklist.exe
2112	tasklist.exe
1756	tasklist.exe
2168	tasklist.exe
2420	tasklist.exe
3088	tasklist.exe
6020	tasklist.exe
1360	tasklist.exe
4712	tasklist.exe
1880	tasklist.exe
2488	tasklist.exe
4764	tasklist.exe
2632	tasklist.exe
1432	tasklist.exe
4500	tasklist.exe
3264	tasklist.exe
5224	tasklist.exe
2096	tasklist.exe
4496	tasklist.exe
3208	tasklist.exe
5248	tasklist.exe
2108	tasklist.exe
2128	tasklist.exe
4468	tasklist.exe
2496	tasklist.exe
3804	tasklist.exe
1380	tasklist.exe
1652	tasklist.exe
4268	tasklist.exe
3280	tasklist.exe
5076	tasklist.exe
4308	tasklist.exe
5844	tasklist.exe
4460	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1876	timeout.exe
1928	timeout.exe
5780	timeout.exe
4400	timeout.exe
1592	timeout.exe
556	timeout.exe
1712	timeout.exe
5316	timeout.exe
3112	timeout.exe
4224	timeout.exe
4768	timeout.exe
4320	timeout.exe
5104	timeout.exe
4104	timeout.exe
6132	timeout.exe
2520	timeout.exe
4644	timeout.exe
4496	timeout.exe
608	timeout.exe
5484	timeout.exe
984	timeout.exe
5040	timeout.exe
3008	timeout.exe
4624	timeout.exe
5328	timeout.exe
6032	timeout.exe
4560	timeout.exe
1868	timeout.exe
4972	timeout.exe
1436	timeout.exe
216	timeout.exe
4340	timeout.exe
380	timeout.exe
3716	timeout.exe
5616	timeout.exe
1344	timeout.exe
5060	timeout.exe
5220	timeout.exe
3824	timeout.exe
4192	timeout.exe
4644	timeout.exe
4160	timeout.exe
668	timeout.exe
228	timeout.exe
1484	timeout.exe
756	timeout.exe
5500	timeout.exe
1352	timeout.exe
3160	timeout.exe
5268	timeout.exe
4340	timeout.exe
568	timeout.exe
2636	timeout.exe
4628	timeout.exe
4188	timeout.exe
4164	timeout.exe
228	timeout.exe
5740	timeout.exe
5220	timeout.exe
216	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1128	powershell.exe
5520	powershell.exe
1128	powershell.exe
5520	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	5248	tasklist.exe
Token: SeDebugPrivilege	4712	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe
Token: SeDebugPrivilege	1472	tasklist.exe
Token: SeDebugPrivilege	2108	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	1468	tasklist.exe
Token: SeDebugPrivilege	2420	tasklist.exe
Token: SeDebugPrivilege	3088	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	6020	tasklist.exe
Token: SeDebugPrivilege	468	tasklist.exe
Token: SeDebugPrivilege	740	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2372	tasklist.exe
Token: SeDebugPrivilege	4468	tasklist.exe
Token: SeDebugPrivilege	5844	tasklist.exe
Token: SeDebugPrivilege	1652	tasklist.exe
Token: SeDebugPrivilege	4460	tasklist.exe
Token: SeDebugPrivilege	4268	tasklist.exe
Token: SeDebugPrivilege	3280	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeDebugPrivilege	4764	tasklist.exe
Token: SeDebugPrivilege	2328	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe
Token: SeDebugPrivilege	5076	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	1784	tasklist.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeDebugPrivilege	3644	tasklist.exe
Token: SeDebugPrivilege	5224	tasklist.exe
Token: SeDebugPrivilege	4904	tasklist.exe
Token: SeDebugPrivilege	1432	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	2496	tasklist.exe
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	2628	tasklist.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeDebugPrivilege	3208	tasklist.exe
Token: SeDebugPrivilege	920	tasklist.exe
Token: SeDebugPrivilege	2356	tasklist.exe
Token: SeDebugPrivilege	3532	tasklist.exe
Token: SeDebugPrivilege	2176	tasklist.exe
Token: SeDebugPrivilege	2112	tasklist.exe
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	4436	tasklist.exe
Token: SeDebugPrivilege	2232	tasklist.exe
Token: SeDebugPrivilege	1880	tasklist.exe
Token: SeDebugPrivilege	4500	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 5152	5976	2026-05-04_b4e884ac2f5c2c7a53d71178190610d9_icedid_njrat_stealc.exe	80
PID 5152 wrote to memory of 4240	5152	cmd.exe	82
PID 5976 wrote to memory of 3744	5976	2026-05-04_b4e884ac2f5c2c7a53d71178190610d9_icedid_njrat_stealc.exe	83
PID 3744 wrote to memory of 5536	3744	PeerService.exe	86
PID 3744 wrote to memory of 5944	3744	PeerService.exe	87
PID 5944 wrote to memory of 1756	5944	cmd.exe	91
PID 5944 wrote to memory of 724	5944	cmd.exe	92
PID 5536 wrote to memory of 1128	5536	cmd.exe	94
PID 4124 wrote to memory of 1832	4124	PeerService.exe	95
PID 4124 wrote to memory of 5936	4124	PeerService.exe	96
PID 1832 wrote to memory of 5520	1832	cmd.exe	100
PID 5936 wrote to memory of 4808	5936	cmd.exe	101
PID 5936 wrote to memory of 1492	5936	cmd.exe	102
PID 5944 wrote to memory of 4340	5944	cmd.exe	103
PID 5936 wrote to memory of 5220	5936	cmd.exe	104
PID 5944 wrote to memory of 2168	5944	cmd.exe	105
PID 5944 wrote to memory of 2360	5944	cmd.exe	106
PID 5936 wrote to memory of 1560	5936	cmd.exe	107
PID 5936 wrote to memory of 4216	5936	cmd.exe	108
PID 5944 wrote to memory of 2520	5944	cmd.exe	109
PID 5936 wrote to memory of 756	5936	cmd.exe	110
PID 5936 wrote to memory of 5248	5936	cmd.exe	111
PID 5936 wrote to memory of 4592	5936	cmd.exe	112
PID 5944 wrote to memory of 4712	5944	cmd.exe	113
PID 5944 wrote to memory of 4912	5944	cmd.exe	114
PID 5936 wrote to memory of 4624	5936	cmd.exe	115
PID 5944 wrote to memory of 4644	5944	cmd.exe	116
PID 5944 wrote to memory of 1772	5944	cmd.exe	117
PID 5944 wrote to memory of 4696	5944	cmd.exe	118
PID 5936 wrote to memory of 1472	5936	cmd.exe	119
PID 5936 wrote to memory of 3952	5936	cmd.exe	120
PID 5944 wrote to memory of 568	5944	cmd.exe	121
PID 5936 wrote to memory of 4496	5936	cmd.exe	122
PID 5936 wrote to memory of 2108	5936	cmd.exe	123
PID 5936 wrote to memory of 668	5936	cmd.exe	124
PID 5944 wrote to memory of 2488	5944	cmd.exe	125
PID 5944 wrote to memory of 5012	5944	cmd.exe	126
PID 5936 wrote to memory of 4768	5936	cmd.exe	127
PID 5944 wrote to memory of 1876	5944	cmd.exe	128
PID 5936 wrote to memory of 1468	5936	cmd.exe	129
PID 5936 wrote to memory of 2388	5936	cmd.exe	130
PID 5944 wrote to memory of 2420	5944	cmd.exe	131
PID 5944 wrote to memory of 1824	5944	cmd.exe	132
PID 5936 wrote to memory of 228	5936	cmd.exe	133
PID 5944 wrote to memory of 216	5944	cmd.exe	134
PID 5936 wrote to memory of 3088	5936	cmd.exe	135
PID 5936 wrote to memory of 5372	5936	cmd.exe	136
PID 5944 wrote to memory of 1380	5944	cmd.exe	137
PID 5944 wrote to memory of 5280	5944	cmd.exe	138
PID 5936 wrote to memory of 1868	5936	cmd.exe	139
PID 5944 wrote to memory of 5328	5944	cmd.exe	140
PID 5936 wrote to memory of 6020	5936	cmd.exe	141
PID 5936 wrote to memory of 744	5936	cmd.exe	142
PID 5944 wrote to memory of 468	5944	cmd.exe	143
PID 5944 wrote to memory of 428	5944	cmd.exe	144
PID 5944 wrote to memory of 1712	5944	cmd.exe	145
PID 5936 wrote to memory of 3824	5936	cmd.exe	146
PID 5944 wrote to memory of 740	5944	cmd.exe	147
PID 5944 wrote to memory of 2292	5944	cmd.exe	148
PID 5936 wrote to memory of 2128	5936	cmd.exe	149
PID 5936 wrote to memory of 6072	5936	cmd.exe	150
PID 5944 wrote to memory of 608	5944	cmd.exe	151
PID 5936 wrote to memory of 2636	5936	cmd.exe	152
PID 5936 wrote to memory of 2372	5936	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-04_b4e884ac2f5c2c7a53d71178190610d9_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_b4e884ac2f5c2c7a53d71178190610d9_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4240
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:724
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2168
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2360
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4712
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2488
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5012
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2420
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1380
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:428
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2656
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3280
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2328
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1672
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5080
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5144
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3644
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5224
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3892
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2596
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3532
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:608
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1880
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1436
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3648
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4560

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5520
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4216
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4592
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2388
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1868
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6072
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1344
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4160
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4240
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5984
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5856
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3936
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:724
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4400
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4620
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2456
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3348
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5604
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4320
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5040
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1628
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1344
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4924
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5616
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tuhezdhk.bqc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tuhezdhk.bqc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 8.0MB
SHA256 7e8e3496b741279bf90b04312085488f71c10f991fb5641aac0cf7178cfaef57
MD5 87a7792df2dbec76483bec35be7b6405
SHA1 c45b0da2c343aa5a74ab90baa93e910a92e854c3
SHA512 8b603531497eff2d45a004be28eae93e31fa272b744ca942bc5577cfd91ebc28878438534d9e81e5dcf3a804bb5ddeb5e4900b7c99a509bf6eb4576820e4e10f
SSDEEP 196608:s+hx9ekESByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CfByQyVG/uzGNI:L9egNSG/lVrl3KExL3JzATzCJNSG/lI
TLSH
T15D86022BB26901E8E1BFD17CC9165903EBB2780543A097DF12E046A62F73BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-28-0x0000024E68E90000-0x0000024E68EB2000-memory.dmp

Download

memory/1128-64-0x0000024E68E40000-0x0000024E68E52000-memory.dmp

Download

memory/1128-63-0x0000024E688B0000-0x0000024E688BC000-memory.dmp

Download

memory/5520-52-0x000002689FCA0000-0x000002689FCBA000-memory.dmp

Download

memory/5520-51-0x000002689FC40000-0x000002689FC4A000-memory.dmp

Download

memory/5520-53-0x000002689FC50000-0x000002689FC58000-memory.dmp

Download

memory/5520-54-0x000002689FC80000-0x000002689FC86000-memory.dmp

Download

memory/5520-55-0x000002689FC90000-0x000002689FC9A000-memory.dmp

Download

memory/5520-59-0x000002689F4D0000-0x000002689F4E2000-memory.dmp

Download

memory/5520-58-0x0000026886F40000-0x0000026886F4C000-memory.dmp

Download

memory/5520-50-0x000002689FC60000-0x000002689FC7C000-memory.dmp

Download

memory/5520-43-0x000002689FAE0000-0x000002689FAEA000-memory.dmp

Download

memory/5520-42-0x000002689F910000-0x000002689F9C3000-memory.dmp

Download

memory/5520-41-0x000002689F8F0000-0x000002689F90C000-memory.dmp

Download