5ba1131b6749b37af14b9f42d1336d89532a7e15b12c3925d8a8990b2edf4089

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_71dc8757ee46ed9d36a3682ab0bf7d5b_icedid_njrat_stealc.exe
Size 5.3MB
Sample260505-ryrmxaas2s
SHA256 5ba1131b6749b37af14b9f42d1336d89532a7e15b12c3925d8a8990b2edf4089
MD5 71dc8757ee46ed9d36a3682ab0bf7d5b
SHA1 529fa567bf778131b47ac5f5d614929f0430d9b0
SHA512 1b2db0a17ea34b2557be53436a8171a8a28bad1ad2e52a73f7bf3d57a8b913f83bbdd35e487872d8885538f38a482d9fdf646cc856adb8f044ec89433b31bebf
SSDEEP 98304:s+hxpLJlKkvs7WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4W:s+hx9ekESByQyVG/uzGNVyAl3K8fCGl
TLSH
T16B46F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5800	powershell.exe
3320	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-05-05_71dc8757ee46ed9d36a3682ab0bf7d5b_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1240	PeerService.exe
4392	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
3984	tasklist.exe
2704	tasklist.exe
4844	tasklist.exe
1688	tasklist.exe
3916	tasklist.exe
2124	tasklist.exe
4160	tasklist.exe
4380	tasklist.exe
1152	tasklist.exe
4636	tasklist.exe
1648	tasklist.exe
2288	tasklist.exe
2240	tasklist.exe
3976	tasklist.exe
956	tasklist.exe
5328	tasklist.exe
5244	tasklist.exe
6108	tasklist.exe
5484	tasklist.exe
5944	tasklist.exe
6088	tasklist.exe
5240	tasklist.exe
5392	tasklist.exe
1924	tasklist.exe
4928	tasklist.exe
1852	tasklist.exe
4208	tasklist.exe
4004	tasklist.exe
3900	tasklist.exe
3172	tasklist.exe
5856	tasklist.exe
5184	tasklist.exe
2236	tasklist.exe
5288	tasklist.exe
6072	tasklist.exe
5452	tasklist.exe
4080	tasklist.exe
4744	tasklist.exe
5432	tasklist.exe
3512	tasklist.exe
5036	tasklist.exe
5020	tasklist.exe
5496	tasklist.exe
5284	tasklist.exe
4164	tasklist.exe
5056	tasklist.exe
4388	tasklist.exe
5740	tasklist.exe
5408	tasklist.exe
1992	tasklist.exe
5760	tasklist.exe
3944	tasklist.exe
2160	tasklist.exe
3404	tasklist.exe
3944	tasklist.exe
3364	tasklist.exe
2044	tasklist.exe
4696	tasklist.exe
3484	tasklist.exe
1472	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3460	timeout.exe
1572	timeout.exe
3464	timeout.exe
1648	timeout.exe
4708	timeout.exe
5528	timeout.exe
440	timeout.exe
3392	timeout.exe
4416	timeout.exe
4840	timeout.exe
5800	timeout.exe
3504	timeout.exe
1516	timeout.exe
5056	timeout.exe
3920	timeout.exe
5548	timeout.exe
6096	timeout.exe
1364	timeout.exe
5628	timeout.exe
5088	timeout.exe
2940	timeout.exe
1752	timeout.exe
3336	timeout.exe
5696	timeout.exe
3544	timeout.exe
6136	timeout.exe
3920	timeout.exe
3704	timeout.exe
4952	timeout.exe
3780	timeout.exe
4144	timeout.exe
4492	timeout.exe
1952	timeout.exe
3948	timeout.exe
5796	timeout.exe
3892	timeout.exe
1396	timeout.exe
4220	timeout.exe
4476	timeout.exe
1852	timeout.exe
5904	timeout.exe
1724	timeout.exe
5920	timeout.exe
4584	timeout.exe
5820	timeout.exe
328	timeout.exe
2068	timeout.exe
4568	timeout.exe
5444	timeout.exe
3476	timeout.exe
1032	timeout.exe
1972	timeout.exe
2956	timeout.exe
4636	timeout.exe
3916	timeout.exe
2328	timeout.exe
2568	timeout.exe
4904	timeout.exe
1960	timeout.exe
3912	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5800	powershell.exe
3320	powershell.exe
5800	powershell.exe
5800	powershell.exe
3320	powershell.exe
3320	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	tasklist.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	4928	tasklist.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	3404	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	3172	tasklist.exe
Token: SeDebugPrivilege	6108	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	3512	tasklist.exe
Token: SeDebugPrivilege	4380	tasklist.exe
Token: SeDebugPrivilege	5496	tasklist.exe
Token: SeDebugPrivilege	3484	tasklist.exe
Token: SeDebugPrivilege	5484	tasklist.exe
Token: SeDebugPrivilege	5288	tasklist.exe
Token: SeDebugPrivilege	5760	tasklist.exe
Token: SeDebugPrivilege	2240	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	6072	tasklist.exe
Token: SeDebugPrivilege	5452	tasklist.exe
Token: SeDebugPrivilege	4208	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	5184	tasklist.exe
Token: SeDebugPrivilege	5432	tasklist.exe
Token: SeDebugPrivilege	5944	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	4160	tasklist.exe
Token: SeDebugPrivilege	5856	tasklist.exe
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeDebugPrivilege	4004	tasklist.exe
Token: SeDebugPrivilege	5056	tasklist.exe
Token: SeDebugPrivilege	4080	tasklist.exe
Token: SeDebugPrivilege	956	tasklist.exe
Token: SeDebugPrivilege	1152	tasklist.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	2704	tasklist.exe
Token: SeDebugPrivilege	4636	tasklist.exe
Token: SeDebugPrivilege	6088	tasklist.exe
Token: SeDebugPrivilege	4844	tasklist.exe
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	5240	tasklist.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	1472	tasklist.exe
Token: SeDebugPrivilege	1648	tasklist.exe
Token: SeDebugPrivilege	1688	tasklist.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	2044	tasklist.exe
Token: SeDebugPrivilege	2236	tasklist.exe
Token: SeDebugPrivilege	5392	tasklist.exe
Token: SeDebugPrivilege	5284	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	5328	tasklist.exe
Token: SeDebugPrivilege	5020	tasklist.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	4696	tasklist.exe
Token: SeDebugPrivilege	1924	tasklist.exe
Token: SeDebugPrivilege	5244	tasklist.exe
Token: SeDebugPrivilege	5408	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4076	972	2026-05-05_71dc8757ee46ed9d36a3682ab0bf7d5b_icedid_njrat_stealc.exe	86
PID 4076 wrote to memory of 3956	4076	cmd.exe	88
PID 972 wrote to memory of 1240	972	2026-05-05_71dc8757ee46ed9d36a3682ab0bf7d5b_icedid_njrat_stealc.exe	89
PID 1240 wrote to memory of 4248	1240	PeerService.exe	92
PID 1240 wrote to memory of 452	1240	PeerService.exe	93
PID 452 wrote to memory of 2160	452	cmd.exe	96
PID 452 wrote to memory of 4688	452	cmd.exe	97
PID 4248 wrote to memory of 5800	4248	cmd.exe	98
PID 4392 wrote to memory of 5304	4392	PeerService.exe	101
PID 4392 wrote to memory of 5112	4392	PeerService.exe	102
PID 5304 wrote to memory of 3320	5304	cmd.exe	106
PID 5112 wrote to memory of 4928	5112	cmd.exe	107
PID 5112 wrote to memory of 1808	5112	cmd.exe	108
PID 5112 wrote to memory of 3464	5112	cmd.exe	109
PID 452 wrote to memory of 2956	452	cmd.exe	110
PID 452 wrote to memory of 1992	452	cmd.exe	111
PID 452 wrote to memory of 4492	452	cmd.exe	112
PID 5112 wrote to memory of 3404	5112	cmd.exe	113
PID 5112 wrote to memory of 1976	5112	cmd.exe	114
PID 5112 wrote to memory of 3920	5112	cmd.exe	115
PID 452 wrote to memory of 4416	452	cmd.exe	116
PID 5112 wrote to memory of 3172	5112	cmd.exe	118
PID 5112 wrote to memory of 1692	5112	cmd.exe	119
PID 452 wrote to memory of 6108	452	cmd.exe	120
PID 452 wrote to memory of 2228	452	cmd.exe	121
PID 5112 wrote to memory of 2068	5112	cmd.exe	122
PID 452 wrote to memory of 1952	452	cmd.exe	123
PID 452 wrote to memory of 1852	452	cmd.exe	127
PID 452 wrote to memory of 1796	452	cmd.exe	128
PID 5112 wrote to memory of 3512	5112	cmd.exe	129
PID 5112 wrote to memory of 3212	5112	cmd.exe	130
PID 5112 wrote to memory of 4568	5112	cmd.exe	131
PID 452 wrote to memory of 4636	452	cmd.exe	132
PID 5112 wrote to memory of 4380	5112	cmd.exe	136
PID 5112 wrote to memory of 6140	5112	cmd.exe	137
PID 452 wrote to memory of 5496	452	cmd.exe	138
PID 452 wrote to memory of 2116	452	cmd.exe	139
PID 5112 wrote to memory of 5444	5112	cmd.exe	140
PID 452 wrote to memory of 6136	452	cmd.exe	141
PID 5112 wrote to memory of 3484	5112	cmd.exe	142
PID 5112 wrote to memory of 1320	5112	cmd.exe	143
PID 452 wrote to memory of 5484	452	cmd.exe	144
PID 452 wrote to memory of 5192	452	cmd.exe	145
PID 5112 wrote to memory of 4840	5112	cmd.exe	146
PID 452 wrote to memory of 5628	452	cmd.exe	147
PID 5112 wrote to memory of 5288	5112	cmd.exe	149
PID 5112 wrote to memory of 4744	5112	cmd.exe	150
PID 452 wrote to memory of 5760	452	cmd.exe	151
PID 452 wrote to memory of 4016	452	cmd.exe	152
PID 5112 wrote to memory of 1396	5112	cmd.exe	153
PID 452 wrote to memory of 3476	452	cmd.exe	154
PID 452 wrote to memory of 2240	452	cmd.exe	155
PID 452 wrote to memory of 5340	452	cmd.exe	156
PID 5112 wrote to memory of 5036	5112	cmd.exe	157
PID 5112 wrote to memory of 5352	5112	cmd.exe	158
PID 5112 wrote to memory of 1724	5112	cmd.exe	159
PID 452 wrote to memory of 1648	452	cmd.exe	160
PID 5112 wrote to memory of 6072	5112	cmd.exe	161
PID 452 wrote to memory of 5452	452	cmd.exe	162
PID 5112 wrote to memory of 5732	5112	cmd.exe	163
PID 452 wrote to memory of 4472	452	cmd.exe	164
PID 452 wrote to memory of 4708	452	cmd.exe	165
PID 5112 wrote to memory of 4220	5112	cmd.exe	166
PID 5112 wrote to memory of 4208	5112	cmd.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-05_71dc8757ee46ed9d36a3682ab0bf7d5b_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_71dc8757ee46ed9d36a3682ab0bf7d5b_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3956
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2160
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4688
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6108
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1852
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4636
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5192
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3944
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5896
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2940
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4688
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5856
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3976
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1152
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3388
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2704
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2392
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3336
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6088
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4748
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2236
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4164
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1536
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5020
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4968
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2124
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3732
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4696
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3504
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4492

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1808
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2068
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4568
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1320
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4840
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3440
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6096
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3688
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1936
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1048
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1664
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4904
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4144
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4652
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4232
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3912
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5960
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2548
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3892
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1292
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5548
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6096
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bby21mda.qhf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bby21mda.qhf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.1MB
SHA256 1ba655298869feb14237904e6ab81ca24f06f8276cb940b6611684d45886155d
MD5 0f0318bee71c7b574229b467ce093f43
SHA1 47943531a2a1f2b62d57da8e050bf1b145fbedd7
SHA512 b4c96133440d587df9dead4a3bfe0fbc31b68d2c1d1282ed32805afa72a616cda2094cd2202b8878172075131953a3664a436a35364b2efe92df24deb8e676c8
SSDEEP 196608:s+hx9ekESByQyVG/uzGNVyAl3K8fCGJByQyVG/uzGNVyv:L9egNSG/lVrl3KEdNSG/lV+
TLSH
T1DA76016BB26901E8D1BFD17CC9065907EBB2780543A0A6CF12E046A62F73BE14F7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3320-39-0x0000019AD34F0000-0x0000019AD34FC000-memory.dmp

Download

memory/5800-27-0x000002CBC3F60000-0x000002CBC3F82000-memory.dmp

Download

memory/5800-40-0x000002CBABC00000-0x000002CBABC0C000-memory.dmp

Download