730f13a5d450d1d8b6c9bac69fa2dc0d2898932de1a2df6a50e495821579242d

Analysis

max time kernel
38s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_174dcb4543c6d2e508b099fe5d930b2f_icedid_njrat_stealc.exe
Size 6.4MB
Sample260516-3qcdssd17p
SHA256 730f13a5d450d1d8b6c9bac69fa2dc0d2898932de1a2df6a50e495821579242d
MD5 174dcb4543c6d2e508b099fe5d930b2f
SHA1 abe4aa8d30bfcdcd8861664f954620b3263ea630
SHA512 2e2abba9cfd271bf39d4fedb1afc57543c96c9903d2bdf53ae27f81f312d41058a38170d977903036d35feaff03efbc6a9366219aede25b0286ad7c17da8e00d
SSDEEP 196608:s+hx9ekExByQyVG/uzGNVyAl3K8fCGnbP3JzATd:L9etNSG/lVrl3KExL3JzATd
TLSH
T18066012BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4892	powershell.exe
5968	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5640	PeerService.exe
3752	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
1416	tasklist.exe
4956	tasklist.exe
4388	tasklist.exe
1656	tasklist.exe
4276	tasklist.exe
1416	tasklist.exe
1100	tasklist.exe
2652	tasklist.exe
3256	tasklist.exe
332	tasklist.exe
1284	tasklist.exe
2336	tasklist.exe
3772	tasklist.exe
4752	tasklist.exe
620	tasklist.exe
4172	tasklist.exe
6076	tasklist.exe
4744	tasklist.exe
4792	tasklist.exe
652	tasklist.exe
5400	tasklist.exe
2176	tasklist.exe
2488	tasklist.exe
2056	tasklist.exe
5568	tasklist.exe
3372	tasklist.exe
272	tasklist.exe
2632	tasklist.exe
1264	tasklist.exe
2016	tasklist.exe
4744	tasklist.exe
1088	tasklist.exe
1992	tasklist.exe
3780	tasklist.exe
3656	tasklist.exe
5240	tasklist.exe
3720	tasklist.exe
1032	tasklist.exe
4648	tasklist.exe
5076	tasklist.exe
4536	tasklist.exe
4248	tasklist.exe
4020	tasklist.exe
4116	tasklist.exe
3980	tasklist.exe
1872	tasklist.exe
2256	tasklist.exe
3812	tasklist.exe
2300	tasklist.exe
3372	tasklist.exe
3192	tasklist.exe
4148	tasklist.exe
2372	tasklist.exe
2052	tasklist.exe
5756	tasklist.exe
2960	tasklist.exe
4576	tasklist.exe
1508	tasklist.exe
1168	tasklist.exe
3808	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3484	timeout.exe
5048	timeout.exe
5116	timeout.exe
3356	timeout.exe
4700	timeout.exe
5756	timeout.exe
5196	timeout.exe
3356	timeout.exe
4264	timeout.exe
2260	timeout.exe
1548	timeout.exe
2568	timeout.exe
4760	timeout.exe
4556	timeout.exe
5340	timeout.exe
5828	timeout.exe
3760	timeout.exe
2472	timeout.exe
3424	timeout.exe
4720	timeout.exe
4388	timeout.exe
3772	timeout.exe
2716	timeout.exe
2272	timeout.exe
2680	timeout.exe
656	timeout.exe
5260	timeout.exe
4028	timeout.exe
2500	timeout.exe
564	timeout.exe
2212	timeout.exe
5032	timeout.exe
3904	timeout.exe
5072	timeout.exe
5436	timeout.exe
5332	timeout.exe
6048	timeout.exe
2752	timeout.exe
4412	timeout.exe
924	timeout.exe
2876	timeout.exe
4312	timeout.exe
5336	timeout.exe
4188	timeout.exe
2092	timeout.exe
4760	timeout.exe
5548	timeout.exe
3320	timeout.exe
4776	timeout.exe
3916	timeout.exe
4372	timeout.exe
5780	timeout.exe
5072	timeout.exe
5536	timeout.exe
5052	timeout.exe
5440	timeout.exe
5852	timeout.exe
2328	timeout.exe
5140	timeout.exe
3508	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4892	powershell.exe
4892	powershell.exe
5968	powershell.exe
5968	powershell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeDebugPrivilege	3772	tasklist.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	2960	tasklist.exe
Token: SeDebugPrivilege	1284	tasklist.exe
Token: SeDebugPrivilege	3192	tasklist.exe
Token: SeDebugPrivilege	2176	tasklist.exe
Token: SeDebugPrivilege	3812	tasklist.exe
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	2336	tasklist.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	1032	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	1088	tasklist.exe
Token: SeDebugPrivilege	272	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	620	tasklist.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 5872	492	2026-05-16_174dcb4543c6d2e508b099fe5d930b2f_icedid_njrat_stealc.exe	80
PID 5872 wrote to memory of 3688	5872	cmd.exe	82
PID 492 wrote to memory of 5640	492	2026-05-16_174dcb4543c6d2e508b099fe5d930b2f_icedid_njrat_stealc.exe	83
PID 5640 wrote to memory of 1444	5640	PeerService.exe	85
PID 5640 wrote to memory of 5356	5640	PeerService.exe	87
PID 1444 wrote to memory of 4892	1444	cmd.exe	89
PID 5356 wrote to memory of 1416	5356	cmd.exe	92
PID 5356 wrote to memory of 4664	5356	cmd.exe	93
PID 3752 wrote to memory of 4000	3752	PeerService.exe	96
PID 3752 wrote to memory of 5628	3752	PeerService.exe	97
PID 5628 wrote to memory of 3772	5628	cmd.exe	100
PID 5628 wrote to memory of 5148	5628	cmd.exe	101
PID 4000 wrote to memory of 5968	4000	cmd.exe	102
PID 5356 wrote to memory of 656	5356	cmd.exe	103
PID 5628 wrote to memory of 5116	5628	cmd.exe	104
PID 5628 wrote to memory of 2960	5628	cmd.exe	105
PID 5628 wrote to memory of 5976	5628	cmd.exe	106
PID 5356 wrote to memory of 1284	5356	cmd.exe	107
PID 5356 wrote to memory of 2516	5356	cmd.exe	108
PID 5628 wrote to memory of 4264	5628	cmd.exe	109
PID 5356 wrote to memory of 5852	5356	cmd.exe	110
PID 5628 wrote to memory of 3192	5628	cmd.exe	111
PID 5628 wrote to memory of 5656	5628	cmd.exe	112
PID 5356 wrote to memory of 2176	5356	cmd.exe	113
PID 5356 wrote to memory of 5176	5356	cmd.exe	114
PID 5628 wrote to memory of 2092	5628	cmd.exe	115
PID 5356 wrote to memory of 5072	5356	cmd.exe	116
PID 5356 wrote to memory of 3812	5356	cmd.exe	117
PID 5356 wrote to memory of 2816	5356	cmd.exe	118
PID 5628 wrote to memory of 4752	5628	cmd.exe	119
PID 5628 wrote to memory of 3276	5628	cmd.exe	120
PID 5356 wrote to memory of 2328	5356	cmd.exe	121
PID 5628 wrote to memory of 5140	5628	cmd.exe	122
PID 5628 wrote to memory of 2336	5628	cmd.exe	123
PID 5628 wrote to memory of 3308	5628	cmd.exe	124
PID 5356 wrote to memory of 4744	5356	cmd.exe	125
PID 5356 wrote to memory of 4440	5356	cmd.exe	126
PID 5628 wrote to memory of 2260	5628	cmd.exe	127
PID 5356 wrote to memory of 4412	5356	cmd.exe	128
PID 5356 wrote to memory of 1032	5356	cmd.exe	129
PID 5356 wrote to memory of 5536	5356	cmd.exe	130
PID 5628 wrote to memory of 2300	5628	cmd.exe	131
PID 5628 wrote to memory of 4880	5628	cmd.exe	132
PID 5356 wrote to memory of 5436	5356	cmd.exe	133
PID 5628 wrote to memory of 3508	5628	cmd.exe	134
PID 5628 wrote to memory of 1088	5628	cmd.exe	135
PID 5628 wrote to memory of 5208	5628	cmd.exe	136
PID 5356 wrote to memory of 272	5356	cmd.exe	137
PID 5356 wrote to memory of 232	5356	cmd.exe	138
PID 5628 wrote to memory of 3356	5628	cmd.exe	139
PID 5356 wrote to memory of 1548	5356	cmd.exe	140
PID 5356 wrote to memory of 1992	5356	cmd.exe	141
PID 5356 wrote to memory of 1508	5356	cmd.exe	142
PID 5628 wrote to memory of 620	5628	cmd.exe	143
PID 5628 wrote to memory of 5716	5628	cmd.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-16_174dcb4543c6d2e508b099fe5d930b2f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_174dcb4543c6d2e508b099fe5d930b2f_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3688
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4664
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1284
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5176
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3812
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5536
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:272
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1508
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2372
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4276
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4792
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2488
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5808
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4248
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3048
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3480
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2932
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3656
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5832
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5656
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1656
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:332
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1508
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4092
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1168
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2848
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2052
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5236
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5592
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3168
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5568
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2428
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5440

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5148
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5656
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3308
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3780
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4700
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3980
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4388
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3904
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4372
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:564
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4020
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6124
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3772
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4148
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2768
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5072
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1104
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2016
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2568
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3424
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3448
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4956
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6048
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2056
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1644
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xkyfyd1t.nge.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkyfyd1t.nge.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 9.4MB
SHA256 953e286a093680eb5ac6c81ea1eff5a08c06c01e3575e3e8260512dd07d7bb3e
MD5 156a3a904354ffd4a33c78dadbdd3510
SHA1 44611b9becfd538e6ddcecc105698f34be244c5f
SHA512 7f1a1cbf8b6d95bfdddf2a0525a843e9f8d4ff9e031e9b2f1cd15284faa22deb288e4458095fefae111c5ff39312352f39d6c358bc495be703661815f3fafcba
SSDEEP 196608:s+hx9ekExByQyVG/uzGNVyAl3K8fCGnbP3JzAThByQyVG/uzGNVyAl3K8fCGz:L9etNSG/lVrl3KExL3JzATnNSG/lVrlp
TLSH
T115A6126BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4892-44-0x0000018FFD6E0000-0x0000018FFD6FC000-memory.dmp

Download

memory/4892-43-0x0000018FFD350000-0x0000018FFD35A000-memory.dmp

Download

memory/4892-36-0x0000018FFD290000-0x0000018FFD343000-memory.dmp

Download

memory/4892-51-0x0000018FFD6C0000-0x0000018FFD6CA000-memory.dmp

Download

memory/4892-52-0x0000018FFD720000-0x0000018FFD73A000-memory.dmp

Download

memory/4892-53-0x0000018FFD6D0000-0x0000018FFD6D8000-memory.dmp

Download

memory/4892-55-0x0000018FFD710000-0x0000018FFD71A000-memory.dmp

Download

memory/4892-54-0x0000018FFD700000-0x0000018FFD706000-memory.dmp

Download

memory/4892-35-0x0000018FFD270000-0x0000018FFD28C000-memory.dmp

Download

memory/4892-24-0x0000018FFD1B0000-0x0000018FFD1D2000-memory.dmp

Download