e127b009c5858465007426dc5fc55f9bea0db9a245e371b706723af50c02203f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_a1ee7d66692941c6a82b0d0ee06789fa_icedid_njrat_stealc.exe
Size 6.8MB
Sample260510-vcrybsft5k
SHA256 e127b009c5858465007426dc5fc55f9bea0db9a245e371b706723af50c02203f
MD5 a1ee7d66692941c6a82b0d0ee06789fa
SHA1 c1e362da389ac327109254a2d12ff7417e5280a6
SHA512 d34aa547d8868fc16b251c35fe3d94d4a0ec8745ee48da90f88e5ceac3e3a4783cf023c06761eb4048dd0e5370e71801c7057f57288173b74f612b6117708271
SSDEEP 196608:M+hBtOkSWByQyVG/uzGNVyAl3K8fCGnbP3JzATC4Cq:btOmNSG/lVrl3KExL3JzATzCq
TLSH
T1B576022BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
60	powershell.exe
4904	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	2026-05-10_a1ee7d66692941c6a82b0d0ee06789fa_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
4200	PeerService.exe
5012	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
2856	tasklist.exe
3304	tasklist.exe
2660	tasklist.exe
540	tasklist.exe
5336	tasklist.exe
5204	tasklist.exe
5584	tasklist.exe
4640	tasklist.exe
5596	tasklist.exe
3500	tasklist.exe
3148	tasklist.exe
4164	tasklist.exe
1568	tasklist.exe
5048	tasklist.exe
5480	tasklist.exe
4288	tasklist.exe
5196	tasklist.exe
4688	tasklist.exe
1728	tasklist.exe
3164	tasklist.exe
6100	tasklist.exe
1320	tasklist.exe
2032	tasklist.exe
5832	tasklist.exe
3684	tasklist.exe
4992	tasklist.exe
2388	tasklist.exe
384	tasklist.exe
4408	tasklist.exe
4512	tasklist.exe
3844	tasklist.exe
3632	tasklist.exe
3360	tasklist.exe
5284	tasklist.exe
3512	tasklist.exe
4140	tasklist.exe
1048	tasklist.exe
4956	tasklist.exe
436	tasklist.exe
4664	tasklist.exe
3036	tasklist.exe
1764	tasklist.exe
5004	tasklist.exe
5020	tasklist.exe
1340	tasklist.exe
5396	tasklist.exe
4948	tasklist.exe
4580	tasklist.exe
1884	tasklist.exe
4544	tasklist.exe
1932	tasklist.exe
3352	tasklist.exe
4928	tasklist.exe
564	tasklist.exe
4028	tasklist.exe
780	tasklist.exe
1556	tasklist.exe
6136	tasklist.exe
4700	tasklist.exe
2400	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
5192	timeout.exe
5804	timeout.exe
5676	timeout.exe
5288	timeout.exe
3424	timeout.exe
2472	timeout.exe
5112	timeout.exe
2392	timeout.exe
6024	timeout.exe
1592	timeout.exe
4216	timeout.exe
3604	timeout.exe
3036	timeout.exe
5320	timeout.exe
900	timeout.exe
3836	timeout.exe
1120	timeout.exe
4156	timeout.exe
6020	timeout.exe
5532	timeout.exe
5988	timeout.exe
4704	timeout.exe
5412	timeout.exe
5508	timeout.exe
1980	timeout.exe
1240	timeout.exe
692	timeout.exe
1504	timeout.exe
5644	timeout.exe
4676	timeout.exe
4220	timeout.exe
4532	timeout.exe
2560	timeout.exe
4696	timeout.exe
2604	timeout.exe
1596	timeout.exe
5604	timeout.exe
5832	timeout.exe
3200	timeout.exe
5476	timeout.exe
556	timeout.exe
4272	timeout.exe
4796	timeout.exe
2424	timeout.exe
2476	timeout.exe
5984	timeout.exe
6100	timeout.exe
4172	timeout.exe
4336	timeout.exe
1912	timeout.exe
3252	timeout.exe
2076	timeout.exe
4492	timeout.exe
5188	timeout.exe
4672	timeout.exe
1856	timeout.exe
4256	timeout.exe
2592	timeout.exe
5852	timeout.exe
1284	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
60	powershell.exe
60	powershell.exe
4904	powershell.exe
4904	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	tasklist.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	3304	tasklist.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	3164	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeDebugPrivilege	1556	tasklist.exe
Token: SeDebugPrivilege	5048	tasklist.exe
Token: SeDebugPrivilege	2660	tasklist.exe
Token: SeDebugPrivilege	6136	tasklist.exe
Token: SeDebugPrivilege	5204	tasklist.exe
Token: SeDebugPrivilege	1764	tasklist.exe
Token: SeDebugPrivilege	3352	tasklist.exe
Token: SeDebugPrivilege	6100	tasklist.exe
Token: SeDebugPrivilege	4928	tasklist.exe
Token: SeDebugPrivilege	2388	tasklist.exe
Token: SeDebugPrivilege	1320	tasklist.exe
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	3360	tasklist.exe
Token: SeDebugPrivilege	564	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	4700	tasklist.exe
Token: SeDebugPrivilege	436	tasklist.exe
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	5284	tasklist.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeDebugPrivilege	3512	tasklist.exe
Token: SeDebugPrivilege	5020	tasklist.exe
Token: SeDebugPrivilege	3148	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	4028	tasklist.exe
Token: SeDebugPrivilege	5832	tasklist.exe
Token: SeDebugPrivilege	5480	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	780	tasklist.exe
Token: SeDebugPrivilege	3684	tasklist.exe
Token: SeDebugPrivilege	5336	tasklist.exe
Token: SeDebugPrivilege	5196	tasklist.exe
Token: SeDebugPrivilege	384	tasklist.exe
Token: SeDebugPrivilege	5584	tasklist.exe
Token: SeDebugPrivilege	1884	tasklist.exe
Token: SeDebugPrivilege	1340	tasklist.exe
Token: SeDebugPrivilege	4140	tasklist.exe
Token: SeDebugPrivilege	1048	tasklist.exe
Token: SeDebugPrivilege	4408	tasklist.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	5396	tasklist.exe
Token: SeDebugPrivilege	4688	tasklist.exe
Token: SeDebugPrivilege	4956	tasklist.exe
Token: SeDebugPrivilege	1728	tasklist.exe
Token: SeDebugPrivilege	2856	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	3036	tasklist.exe
Token: SeDebugPrivilege	5596	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4764	4480	2026-05-10_a1ee7d66692941c6a82b0d0ee06789fa_icedid_njrat_stealc.exe	85
PID 4764 wrote to memory of 4868	4764	cmd.exe	87
PID 4480 wrote to memory of 4200	4480	2026-05-10_a1ee7d66692941c6a82b0d0ee06789fa_icedid_njrat_stealc.exe	88
PID 4200 wrote to memory of 4716	4200	PeerService.exe	90
PID 4200 wrote to memory of 4620	4200	PeerService.exe	92
PID 4620 wrote to memory of 3500	4620	cmd.exe	94
PID 4620 wrote to memory of 5004	4620	cmd.exe	95
PID 4716 wrote to memory of 60	4716	cmd.exe	97
PID 4620 wrote to memory of 5852	4620	cmd.exe	100
PID 5012 wrote to memory of 5888	5012	PeerService.exe	102
PID 5012 wrote to memory of 4972	5012	PeerService.exe	103
PID 5888 wrote to memory of 4904	5888	cmd.exe	106
PID 4972 wrote to memory of 3304	4972	cmd.exe	107
PID 4972 wrote to memory of 2876	4972	cmd.exe	108
PID 4972 wrote to memory of 5288	4972	cmd.exe	109
PID 4620 wrote to memory of 1932	4620	cmd.exe	110
PID 4620 wrote to memory of 4436	4620	cmd.exe	111
PID 4620 wrote to memory of 1980	4620	cmd.exe	112
PID 4972 wrote to memory of 3164	4972	cmd.exe	113
PID 4972 wrote to memory of 4188	4972	cmd.exe	114
PID 4972 wrote to memory of 1596	4972	cmd.exe	115
PID 4620 wrote to memory of 4948	4620	cmd.exe	117
PID 4620 wrote to memory of 1236	4620	cmd.exe	118
PID 4620 wrote to memory of 900	4620	cmd.exe	119
PID 4972 wrote to memory of 1568	4972	cmd.exe	120
PID 4972 wrote to memory of 4464	4972	cmd.exe	121
PID 4972 wrote to memory of 5984	4972	cmd.exe	122
PID 4620 wrote to memory of 1556	4620	cmd.exe	123
PID 4620 wrote to memory of 1404	4620	cmd.exe	124
PID 4620 wrote to memory of 4172	4620	cmd.exe	125
PID 4972 wrote to memory of 5048	4972	cmd.exe	126
PID 4972 wrote to memory of 3096	4972	cmd.exe	127
PID 4972 wrote to memory of 1240	4972	cmd.exe	128
PID 4620 wrote to memory of 2660	4620	cmd.exe	129
PID 4620 wrote to memory of 5544	4620	cmd.exe	130
PID 4620 wrote to memory of 692	4620	cmd.exe	131
PID 4972 wrote to memory of 6136	4972	cmd.exe	132
PID 4972 wrote to memory of 2008	4972	cmd.exe	133
PID 4972 wrote to memory of 5192	4972	cmd.exe	134
PID 4620 wrote to memory of 5204	4620	cmd.exe	135
PID 4620 wrote to memory of 5208	4620	cmd.exe	136
PID 4620 wrote to memory of 3836	4620	cmd.exe	137
PID 4972 wrote to memory of 1764	4972	cmd.exe	138
PID 4972 wrote to memory of 216	4972	cmd.exe	139
PID 4972 wrote to memory of 1120	4972	cmd.exe	140
PID 4620 wrote to memory of 3352	4620	cmd.exe	142
PID 4620 wrote to memory of 1756	4620	cmd.exe	143
PID 4620 wrote to memory of 3424	4620	cmd.exe	144
PID 4972 wrote to memory of 6100	4972	cmd.exe	145
PID 4972 wrote to memory of 1368	4972	cmd.exe	146
PID 4972 wrote to memory of 4272	4972	cmd.exe	147
PID 4620 wrote to memory of 4928	4620	cmd.exe	148
PID 4620 wrote to memory of 2412	4620	cmd.exe	149
PID 4620 wrote to memory of 4216	4620	cmd.exe	150
PID 4972 wrote to memory of 2388	4972	cmd.exe	151
PID 4972 wrote to memory of 2480	4972	cmd.exe	152
PID 4972 wrote to memory of 1504	4972	cmd.exe	153
PID 4620 wrote to memory of 1320	4620	cmd.exe	154
PID 4620 wrote to memory of 3864	4620	cmd.exe	155
PID 4620 wrote to memory of 5644	4620	cmd.exe	156
PID 4972 wrote to memory of 3632	4972	cmd.exe	157
PID 4972 wrote to memory of 2044	4972	cmd.exe	158
PID 4972 wrote to memory of 5988	4972	cmd.exe	159
PID 4620 wrote to memory of 3360	4620	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-10_a1ee7d66692941c6a82b0d0ee06789fa_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_a1ee7d66692941c6a82b0d0ee06789fa_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:60
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3500
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5004
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4436
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1236
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1404
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5204
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5208
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3352
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4928
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1320
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3668
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5284
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4676
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1388
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3148
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5840
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5480
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4128
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5336
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5376
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:384
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:212
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5784
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1960
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4584
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5396
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5284
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4956
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2856
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3148
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3036
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5532

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2876
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4464
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3096
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:216
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4156
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4400
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3604
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3200
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5316
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4256
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1536
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1912
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5584
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5676
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4908
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:616
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4492
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1284
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4960
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f84df996802a7b65b0a58ecd1960f157bdc82f817bae81409eb4184e438ed9b8
MD5 87d9fe9e5ee685ff2b66e5396fcdcb99
SHA1 0ac74edba86591b97d1a7531c3d2e659f0843b7f
SHA512 ce602ffb6822849af961afc13b972d0d344bbfaa50c5fe372cf475f424a9227f788ea64a1dfa9b96d8e01cfa2b7f0f9e695ea001ea37a6c7c235c86931d1cf3e
TLSH
T128112223F78C8920DC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF984CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xheez4ng.dao.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xheez4ng.dao.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 9.5MB
SHA256 8a719927c718e1f4bda2872c7a59f625a37e87184b7e1124bcc5c2f18ecade10
MD5 acfd417d1f512b57491eeb229589fc02
SHA1 f7545d6c37c44a676e72666f738e3f440deed1cc
SHA512 54769790e16a8f77166fdba9113e8718782cc5ecc361a7d486a8088dd70d65d4b888de90641a4416573c62f22a08dc98a36dfa02598e1feb6fc93b401ebed26d
SSDEEP 196608:M+hBtOkSWByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CGByQyVG/uzGNVyAl3K8j:btOmNSG/lVrl3KExL3JzATzCSNSG/lVB
TLSH
T1BFA6126BB26901E8D1BFD17CC9065907EBB2780543A0A7DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-20-0x000001E8EA070000-0x000001E8EA092000-memory.dmp

Download

memory/60-30-0x000001E8CFF00000-0x000001E8D00A1000-memory.dmp

Download

memory/4200-45-0x0000028513A30000-0x0000028513BD1000-memory.dmp

Download

memory/4480-17-0x00000205647F0000-0x0000020564991000-memory.dmp

Download

memory/4904-44-0x000002474AC90000-0x000002474AE31000-memory.dmp

Download

memory/5012-46-0x000001F185940000-0x000001F185AE1000-memory.dmp

Download