d2ad5e3bea9ac76853ff949c190f533442093057d9f2d29078cbf84e8d0b94b8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_31dac2f0e4ff80ade257b2701cb58f68_icedid_njrat_stealc.exe
Size 3.7MB
Sample260506-tegppsas3m
SHA256 d2ad5e3bea9ac76853ff949c190f533442093057d9f2d29078cbf84e8d0b94b8
MD5 31dac2f0e4ff80ade257b2701cb58f68
SHA1 525cca55838be9ce24273ba87f8a92f12d75cd5e
SHA512 80a222c584a1fd7f41c2d22fe2bcc4062e434ae4a12261d834729e38617bd1a8fcd763cca043b9d7bc3a2b7d0a50086977f4e96cb651bd4bf3849f5cf02c8922
SSDEEP 49152:M++MB9P91XphIl8pF58H8KkJrXSCHL4Qu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2qP:M+hBp75VKkEc7WGoqZ92yVG/uzGNV9V
TLSH
T13506D02BB26901ECD1BFD17CC9165907EBB2780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe
5152	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	2026-05-06_31dac2f0e4ff80ade257b2701cb58f68_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
5592	PeerService.exe
5568	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
4584	tasklist.exe
4128	tasklist.exe
5992	tasklist.exe
3480	tasklist.exe
540	tasklist.exe
5024	tasklist.exe
568	tasklist.exe
2460	tasklist.exe
2712	tasklist.exe
2444	tasklist.exe
5388	tasklist.exe
3824	tasklist.exe
5684	tasklist.exe
4260	tasklist.exe
4912	tasklist.exe
6024	tasklist.exe
4768	tasklist.exe
2688	tasklist.exe
5604	tasklist.exe
60	tasklist.exe
4828	tasklist.exe
2716	tasklist.exe
1652	tasklist.exe
1544	tasklist.exe
5748	tasklist.exe
4424	tasklist.exe
4720	tasklist.exe
5560	tasklist.exe
3264	tasklist.exe
5360	tasklist.exe
4500	tasklist.exe
4960	tasklist.exe
1204	tasklist.exe
3940	tasklist.exe
3808	tasklist.exe
2544	tasklist.exe
3756	tasklist.exe
5212	tasklist.exe
5500	tasklist.exe
2124	tasklist.exe
4300	tasklist.exe
5208	tasklist.exe
4932	tasklist.exe
2944	tasklist.exe
2144	tasklist.exe
4100	tasklist.exe
2268	tasklist.exe
2360	tasklist.exe
1488	tasklist.exe
5564	tasklist.exe
1736	tasklist.exe
6004	tasklist.exe
1756	tasklist.exe
5480	tasklist.exe
4896	tasklist.exe
1900	tasklist.exe
3848	tasklist.exe
3448	tasklist.exe
6076	tasklist.exe
2524	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
5240	timeout.exe
5348	timeout.exe
3116	timeout.exe
1732	timeout.exe
788	timeout.exe
3788	timeout.exe
3248	timeout.exe
5232	timeout.exe
5340	timeout.exe
4176	timeout.exe
5348	timeout.exe
4992	timeout.exe
5192	timeout.exe
60	timeout.exe
1876	timeout.exe
2912	timeout.exe
1160	timeout.exe
5096	timeout.exe
3736	timeout.exe
4788	timeout.exe
4812	timeout.exe
4596	timeout.exe
4968	timeout.exe
1552	timeout.exe
4660	timeout.exe
5420	timeout.exe
1092	timeout.exe
2244	timeout.exe
4360	timeout.exe
6084	timeout.exe
5560	timeout.exe
3012	timeout.exe
1224	timeout.exe
3352	timeout.exe
4816	timeout.exe
2252	timeout.exe
3248	timeout.exe
1532	timeout.exe
2228	timeout.exe
628	timeout.exe
836	timeout.exe
3600	timeout.exe
5100	timeout.exe
5828	timeout.exe
5252	timeout.exe
3928	timeout.exe
2508	timeout.exe
5860	timeout.exe
4260	timeout.exe
1344	timeout.exe
1832	timeout.exe
628	timeout.exe
5624	timeout.exe
5028	timeout.exe
636	timeout.exe
4052	timeout.exe
5984	timeout.exe
5092	timeout.exe
1608	timeout.exe
2888	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2228	powershell.exe
2228	powershell.exe
5152	powershell.exe
5152	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	4584	tasklist.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	3448	tasklist.exe
Token: SeDebugPrivilege	2144	tasklist.exe
Token: SeDebugPrivilege	5480	tasklist.exe
Token: SeDebugPrivilege	2716	tasklist.exe
Token: SeDebugPrivilege	1652	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	3940	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	5684	tasklist.exe
Token: SeDebugPrivilege	5560	tasklist.exe
Token: SeDebugPrivilege	4300	tasklist.exe
Token: SeDebugPrivilege	5208	tasklist.exe
Token: SeDebugPrivilege	5564	tasklist.exe
Token: SeDebugPrivilege	6076	tasklist.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	5992	tasklist.exe
Token: SeDebugPrivilege	3808	tasklist.exe
Token: SeDebugPrivilege	5024	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	2544	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	5388	tasklist.exe
Token: SeDebugPrivilege	4260	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	3756	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	3848	tasklist.exe
Token: SeDebugPrivilege	5212	tasklist.exe
Token: SeDebugPrivilege	4932	tasklist.exe
Token: SeDebugPrivilege	3824	tasklist.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	5360	tasklist.exe
Token: SeDebugPrivilege	4500	tasklist.exe
Token: SeDebugPrivilege	4768	tasklist.exe
Token: SeDebugPrivilege	2688	tasklist.exe
Token: SeDebugPrivilege	4912	tasklist.exe
Token: SeDebugPrivilege	1544	tasklist.exe
Token: SeDebugPrivilege	6004	tasklist.exe
Token: SeDebugPrivilege	4960	tasklist.exe
Token: SeDebugPrivilege	5604	tasklist.exe
Token: SeDebugPrivilege	1204	tasklist.exe
Token: SeDebugPrivilege	60	tasklist.exe
Token: SeDebugPrivilege	6024	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	3480	tasklist.exe
Token: SeDebugPrivilege	568	tasklist.exe
Token: SeDebugPrivilege	5748	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3348	4528	2026-05-06_31dac2f0e4ff80ade257b2701cb58f68_icedid_njrat_stealc.exe	86
PID 3348 wrote to memory of 660	3348	cmd.exe	88
PID 4528 wrote to memory of 5592	4528	2026-05-06_31dac2f0e4ff80ade257b2701cb58f68_icedid_njrat_stealc.exe	89
PID 5592 wrote to memory of 4924	5592	PeerService.exe	91
PID 5592 wrote to memory of 5628	5592	PeerService.exe	92
PID 4924 wrote to memory of 2228	4924	cmd.exe	95
PID 5628 wrote to memory of 2124	5628	cmd.exe	97
PID 5628 wrote to memory of 4452	5628	cmd.exe	98
PID 5568 wrote to memory of 6000	5568	PeerService.exe	102
PID 5568 wrote to memory of 4796	5568	PeerService.exe	103
PID 4796 wrote to memory of 4584	4796	cmd.exe	106
PID 4796 wrote to memory of 5024	4796	cmd.exe	107
PID 6000 wrote to memory of 5152	6000	cmd.exe	108
PID 5628 wrote to memory of 1832	5628	cmd.exe	109
PID 4796 wrote to memory of 3788	4796	cmd.exe	110
PID 5628 wrote to memory of 4128	5628	cmd.exe	111
PID 5628 wrote to memory of 4168	5628	cmd.exe	112
PID 4796 wrote to memory of 2944	4796	cmd.exe	113
PID 4796 wrote to memory of 1996	4796	cmd.exe	114
PID 5628 wrote to memory of 3248	5628	cmd.exe	115
PID 4796 wrote to memory of 628	4796	cmd.exe	116
PID 5628 wrote to memory of 3448	5628	cmd.exe	117
PID 5628 wrote to memory of 2268	5628	cmd.exe	118
PID 4796 wrote to memory of 2144	4796	cmd.exe	119
PID 4796 wrote to memory of 1800	4796	cmd.exe	120
PID 5628 wrote to memory of 4260	5628	cmd.exe	121
PID 4796 wrote to memory of 5240	4796	cmd.exe	122
PID 4796 wrote to memory of 5480	4796	cmd.exe	123
PID 4796 wrote to memory of 5304	4796	cmd.exe	124
PID 5628 wrote to memory of 2716	5628	cmd.exe	125
PID 5628 wrote to memory of 5528	5628	cmd.exe	126
PID 4796 wrote to memory of 1092	4796	cmd.exe	127
PID 5628 wrote to memory of 2244	5628	cmd.exe	128
PID 4796 wrote to memory of 1652	4796	cmd.exe	129
PID 4796 wrote to memory of 1884	4796	cmd.exe	130
PID 5628 wrote to memory of 4896	5628	cmd.exe	131
PID 5628 wrote to memory of 4736	5628	cmd.exe	132
PID 4796 wrote to memory of 5096	4796	cmd.exe	133
PID 5628 wrote to memory of 4360	5628	cmd.exe	134
PID 5628 wrote to memory of 1756	5628	cmd.exe	135
PID 5628 wrote to memory of 5236	5628	cmd.exe	136
PID 4796 wrote to memory of 1488	4796	cmd.exe	137
PID 4796 wrote to memory of 5420	4796	cmd.exe	138
PID 5628 wrote to memory of 5100	5628	cmd.exe	139
PID 4796 wrote to memory of 1552	4796	cmd.exe	140
PID 4796 wrote to memory of 4720	4796	cmd.exe	146
PID 4796 wrote to memory of 2592	4796	cmd.exe	147
PID 5628 wrote to memory of 540	5628	cmd.exe	148
PID 5628 wrote to memory of 5500	5628	cmd.exe	149
PID 4796 wrote to memory of 3736	4796	cmd.exe	150
PID 5628 wrote to memory of 5348	5628	cmd.exe	151
PID 4796 wrote to memory of 3940	4796	cmd.exe	154
PID 4796 wrote to memory of 2084	4796	cmd.exe	155
PID 5628 wrote to memory of 2712	5628	cmd.exe	156
PID 5628 wrote to memory of 1944	5628	cmd.exe	157
PID 5628 wrote to memory of 5192	5628	cmd.exe	158
PID 4796 wrote to memory of 4816	4796	cmd.exe	159
PID 5628 wrote to memory of 1900	5628	cmd.exe	160
PID 5628 wrote to memory of 4032	5628	cmd.exe	161
PID 4796 wrote to memory of 5684	4796	cmd.exe	162
PID 4796 wrote to memory of 4188	4796	cmd.exe	163
PID 5628 wrote to memory of 5340	5628	cmd.exe	164
PID 4796 wrote to memory of 4788	4796	cmd.exe	165
PID 4796 wrote to memory of 5560	4796	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-06_31dac2f0e4ff80ade257b2701cb58f68_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_31dac2f0e4ff80ade257b2701cb58f68_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:660
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2228
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2124
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4168
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2268
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2716
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4896
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4736
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5236
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2712
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1944
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4300
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5788
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5208
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:60
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3352
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2544
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3012
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1828
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1296
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2524
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1404
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4768
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2752
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5604
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3480
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:648
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:568
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3728
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5056
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:636

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5024
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:628
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1884
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5096
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1552
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2592
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3812
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5412
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6016
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5168
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3248
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1732
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4176
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4136
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4840
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5560
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1216
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3600
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5472
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4824
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5748
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f84df996802a7b65b0a58ecd1960f157bdc82f817bae81409eb4184e438ed9b8
MD5 87d9fe9e5ee685ff2b66e5396fcdcb99
SHA1 0ac74edba86591b97d1a7531c3d2e659f0843b7f
SHA512 ce602ffb6822849af961afc13b972d0d344bbfaa50c5fe372cf475f424a9227f788ea64a1dfa9b96d8e01cfa2b7f0f9e695ea001ea37a6c7c235c86931d1cf3e
TLSH
T128112223F78C8920DC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF984CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zoigyeru.cv2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zoigyeru.cv2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 5.1MB
SHA256 02af4e5478180cc085fdb23bdddeb3183f107a0350579099cc6ec6c970dd41db
MD5 6230111ec378174a72ed744e38255476
SHA1 28f1e059b8f37da1e0aa0e70ed50908b290425ee
SHA512 f55e14f11c0cd1c01f02686205bee51389b725e3b748e72b82908ec04f42ef68fc1708e4a86a27d681508d9613c4fc0a56b8ea33cb0fdb69ddd34e5b5ff0cbb5
SSDEEP 98304:M+hBp75VKkEc7WGoqZ92yVG/uzGNV9uWGoqZ92yVG/uzGNVi:M+hBt+k/SByQyVG/uzGNVrByQyVG/uzH
TLSH
T13A46F12BB26901E8D1BFD17CC9165907EBB2780503A0A7DF12E046A62F73AE14F7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-27-0x00000157A10A0000-0x00000157A10C2000-memory.dmp

Download

memory/2228-33-0x0000015788B50000-0x0000015788B5C000-memory.dmp

Download

memory/4528-17-0x0000015C110A0000-0x0000015C1114C000-memory.dmp

Download

memory/5152-44-0x000001970FB30000-0x000001970FB3C000-memory.dmp

Download

memory/5568-46-0x00000210808C0000-0x000002108096C000-memory.dmp

Download

memory/5568-70-0x00000210808C0000-0x000002108096C000-memory.dmp

Download

memory/5592-45-0x000002B84AF00000-0x000002B84AFAC000-memory.dmp

Download

memory/5592-69-0x000002B84AF00000-0x000002B84AFAC000-memory.dmp

Download