09436d56c823c92d3b99fa3cccefb24aa1ce035a5cdc89afb03070345aff3e76

Analysis

max time kernel
150s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_d60489a9c7a4265ceffdc356c8574ed9_icedid_njrat_stealc.exe
Size 5.2MB
Sample260524-t7clfsey6v
SHA256 09436d56c823c92d3b99fa3cccefb24aa1ce035a5cdc89afb03070345aff3e76
MD5 d60489a9c7a4265ceffdc356c8574ed9
SHA1 bb327e31a21499d96e9bb15c2203f2d0419a0a0f
SHA512 81e1445a1a99e5cad0b321cfcab6b07cc42702ad403bd54cbc85223742437d97ba312025f2dd58c86a6dd32efc22130b80725ab2447392a9e8e1fe7c4a99ae29
SSDEEP 98304:s+hBp75lKkBckWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQc:s+hBtOkSDByQyVG/uzGNVyAl3K8fCGc
TLSH
T1A546F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5028	powershell.exe
4756	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1688	PeerService.exe
1228	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
4068	tasklist.exe
3988	tasklist.exe
2448	tasklist.exe
1004	tasklist.exe
4220	tasklist.exe
2408	tasklist.exe
1776	tasklist.exe
2020	tasklist.exe
4048	tasklist.exe
1256	tasklist.exe
3448	tasklist.exe
4704	tasklist.exe
4144	tasklist.exe
1936	tasklist.exe
772	tasklist.exe
760	tasklist.exe
3548	tasklist.exe
2360	tasklist.exe
2928	tasklist.exe
580	tasklist.exe
3976	tasklist.exe
1516	tasklist.exe
4544	tasklist.exe
4016	tasklist.exe
4280	tasklist.exe
2028	tasklist.exe
4072	tasklist.exe
2676	tasklist.exe
4964	tasklist.exe
2700	tasklist.exe
4136	tasklist.exe
3908	tasklist.exe
1360	tasklist.exe
4052	tasklist.exe
4116	tasklist.exe
3684	tasklist.exe
4088	tasklist.exe
4920	tasklist.exe
2864	tasklist.exe
3920	tasklist.exe
3904	tasklist.exe
3732	tasklist.exe
2280	tasklist.exe
1416	tasklist.exe
4508	tasklist.exe
4988	tasklist.exe
4680	tasklist.exe
3744	tasklist.exe
4680	tasklist.exe
3716	tasklist.exe
872	tasklist.exe
1596	tasklist.exe
1772	tasklist.exe
4948	tasklist.exe
3984	tasklist.exe
2920	tasklist.exe
72	tasklist.exe
2492	tasklist.exe
4784	tasklist.exe
2624	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2748	timeout.exe
840	timeout.exe
1512	timeout.exe
3416	timeout.exe
1216	timeout.exe
2200	timeout.exe
2960	timeout.exe
3812	timeout.exe
2352	timeout.exe
1096	timeout.exe
2176	timeout.exe
3128	timeout.exe
2088	timeout.exe
2176	timeout.exe
1172	timeout.exe
4268	timeout.exe
4064	timeout.exe
4516	timeout.exe
4516	timeout.exe
2656	timeout.exe
2060	timeout.exe
2228	timeout.exe
4204	timeout.exe
3232	timeout.exe
4948	timeout.exe
3820	timeout.exe
1224	timeout.exe
4504	timeout.exe
4708	timeout.exe
2732	timeout.exe
1292	timeout.exe
4212	timeout.exe
3760	timeout.exe
1068	timeout.exe
1580	timeout.exe
5036	timeout.exe
2732	timeout.exe
2008	timeout.exe
764	timeout.exe
3172	timeout.exe
4316	timeout.exe
3604	timeout.exe
3896	timeout.exe
1504	timeout.exe
1048	timeout.exe
1016	timeout.exe
4524	timeout.exe
2372	timeout.exe
1084	timeout.exe
2624	timeout.exe
1872	timeout.exe
4924	timeout.exe
4924	timeout.exe
1548	timeout.exe
1284	timeout.exe
572	timeout.exe
4648	timeout.exe
992	timeout.exe
4488	timeout.exe
4836	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5028	powershell.exe
5028	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	4920	tasklist.exe
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeDebugPrivilege	1256	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	4136	tasklist.exe
Token: SeDebugPrivilege	4116	tasklist.exe
Token: SeDebugPrivilege	2864	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	2624	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe
Token: SeDebugPrivilege	4144	tasklist.exe
Token: SeDebugPrivilege	1776	tasklist.exe
Token: SeDebugPrivilege	3684	tasklist.exe
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeDebugPrivilege	2028	tasklist.exe
Token: SeDebugPrivilege	2928	tasklist.exe
Token: SeDebugPrivilege	4072	tasklist.exe
Token: SeDebugPrivilege	3920	tasklist.exe
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	2676	tasklist.exe
Token: SeDebugPrivilege	1596	tasklist.exe
Token: SeDebugPrivilege	3448	tasklist.exe
Token: SeDebugPrivilege	1516	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe
Token: SeDebugPrivilege	4988	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	4016	tasklist.exe
Token: SeDebugPrivilege	1936	tasklist.exe
Token: SeDebugPrivilege	3904	tasklist.exe
Token: SeDebugPrivilege	4680	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	2448	tasklist.exe
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeDebugPrivilege	1004	tasklist.exe
Token: SeDebugPrivilege	772	tasklist.exe
Token: SeDebugPrivilege	2920	tasklist.exe
Token: SeDebugPrivilege	3732	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	2408	tasklist.exe
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	72	tasklist.exe
Token: SeDebugPrivilege	4220	tasklist.exe
Token: SeDebugPrivilege	4784	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	2020	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	3744	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	4680	tasklist.exe
Token: SeDebugPrivilege	2700	tasklist.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	4052	tasklist.exe
Token: SeDebugPrivilege	580	tasklist.exe
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	3716	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2836	2984	2026-05-24_d60489a9c7a4265ceffdc356c8574ed9_icedid_njrat_stealc.exe	81
PID 2836 wrote to memory of 3984	2836	cmd.exe	83
PID 2984 wrote to memory of 1688	2984	2026-05-24_d60489a9c7a4265ceffdc356c8574ed9_icedid_njrat_stealc.exe	84
PID 1688 wrote to memory of 2716	1688	PeerService.exe	86
PID 2716 wrote to memory of 5028	2716	cmd.exe	88
PID 1688 wrote to memory of 2444	1688	PeerService.exe	89
PID 2444 wrote to memory of 4920	2444	cmd.exe	93
PID 2444 wrote to memory of 3272	2444	cmd.exe	94
PID 1228 wrote to memory of 1104	1228	PeerService.exe	96
PID 1228 wrote to memory of 404	1228	PeerService.exe	97
PID 404 wrote to memory of 4068	404	cmd.exe	101
PID 404 wrote to memory of 4452	404	cmd.exe	102
PID 1104 wrote to memory of 4756	1104	cmd.exe	103
PID 2444 wrote to memory of 4924	2444	cmd.exe	104
PID 404 wrote to memory of 4488	404	cmd.exe	105
PID 404 wrote to memory of 872	404	cmd.exe	106
PID 404 wrote to memory of 4040	404	cmd.exe	107
PID 2444 wrote to memory of 1256	2444	cmd.exe	108
PID 2444 wrote to memory of 3172	2444	cmd.exe	109
PID 404 wrote to memory of 1580	404	cmd.exe	110
PID 2444 wrote to memory of 2176	2444	cmd.exe	111
PID 2444 wrote to memory of 2360	2444	cmd.exe	112
PID 2444 wrote to memory of 3412	2444	cmd.exe	113
PID 404 wrote to memory of 4136	404	cmd.exe	114
PID 404 wrote to memory of 72	404	cmd.exe	115
PID 2444 wrote to memory of 3128	2444	cmd.exe	116
PID 404 wrote to memory of 4836	404	cmd.exe	117
PID 2444 wrote to memory of 4116	2444	cmd.exe	118
PID 2444 wrote to memory of 844	2444	cmd.exe	119
PID 404 wrote to memory of 2864	404	cmd.exe	120
PID 404 wrote to memory of 4396	404	cmd.exe	121
PID 2444 wrote to memory of 4504	2444	cmd.exe	122
PID 404 wrote to memory of 4948	404	cmd.exe	123
PID 2444 wrote to memory of 3908	2444	cmd.exe	124
PID 2444 wrote to memory of 3324	2444	cmd.exe	125
PID 404 wrote to memory of 2624	404	cmd.exe	126
PID 404 wrote to memory of 2276	404	cmd.exe	127
PID 404 wrote to memory of 4316	404	cmd.exe	128
PID 2444 wrote to memory of 2748	2444	cmd.exe	129
PID 404 wrote to memory of 1360	404	cmd.exe	130
PID 404 wrote to memory of 4276	404	cmd.exe	131
PID 2444 wrote to memory of 4144	2444	cmd.exe	132
PID 2444 wrote to memory of 4260	2444	cmd.exe	133
PID 404 wrote to memory of 4708	404	cmd.exe	134
PID 2444 wrote to memory of 2732	2444	cmd.exe	135
PID 404 wrote to memory of 1776	404	cmd.exe	136
PID 404 wrote to memory of 236	404	cmd.exe	137
PID 2444 wrote to memory of 3684	2444	cmd.exe	138
PID 2444 wrote to memory of 1916	2444	cmd.exe	139
PID 404 wrote to memory of 1292	404	cmd.exe	140
PID 2444 wrote to memory of 2088	2444	cmd.exe	141
PID 404 wrote to memory of 3976	404	cmd.exe	142
PID 404 wrote to memory of 340	404	cmd.exe	143
PID 2444 wrote to memory of 2028	2444	cmd.exe	144
PID 2444 wrote to memory of 2712	2444	cmd.exe	145
PID 404 wrote to memory of 4212	404	cmd.exe	146
PID 2444 wrote to memory of 2960	2444	cmd.exe	147
PID 404 wrote to memory of 2928	404	cmd.exe	148
PID 404 wrote to memory of 4352	404	cmd.exe	149
PID 2444 wrote to memory of 4072	2444	cmd.exe	150
PID 2444 wrote to memory of 3476	2444	cmd.exe	151
PID 404 wrote to memory of 3812	404	cmd.exe	152
PID 2444 wrote to memory of 1016	2444	cmd.exe	153
PID 404 wrote to memory of 3920	404	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-24_d60489a9c7a4265ceffdc356c8574ed9_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_d60489a9c7a4265ceffdc356c8574ed9_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3272
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2176
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3908
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3324
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4260
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3684
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1916
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2676
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4016
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1884
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4704
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2492
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4220
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4404
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4280
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1932
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2700
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4048
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3976
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:580
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4896
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2200

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:72
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4316
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1292
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3896
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1580
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4832
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2680
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5024
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1284
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:72
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4516
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4544
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1760
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4144
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2732
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4060
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4464
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4740
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c82f2726f8ce51fc0d84eb392397b748700470a79032acae4a60c63d1067edcb
MD5 782e4d43fee2487ad2471a9e11efb280
SHA1 17dc94ce4aa72d53aff8024409de3033cfa358f5
SHA512 d16f50a54a1a7c3c1babdc7b90e1b203cf74a18a8f922dcd12d337b31a8ec54a769f7749841116d43dab39bf93cf14acdc5da4a27a0e6127b803bf95f1712541
TLSH
T12421AB33B79CC135C8D9117A108CAD01B1B5C3C7449ECECB7B84C518A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1tk5geg4.b5p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tk5geg4.b5p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.3MB
SHA256 f039498cd142a6ab298a63477a93555779d83d02cca9851c661e0dbf4ba702e3
MD5 c2f2f62c0412ce16adc212c992d6585d
SHA1 32acab13cf2df8e94a6f77cac35466e32dac420a
SHA512 5b99c136921fb0698d1cb10a2d0a4780067d8d6b3604e2e88a558b2909b3e927cea9b8c02b62b5232c5c6abf1dc2be2aa4b5ca7f8b155b695bd456bf6007f822
SSDEEP 196608:s+hBtOkSDByQyVG/uzGNVyAl3K8fCG0ByQyVG/uzGC:7tOZNSG/lVrl3KEuNSG/6
TLSH
T1A466F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77AE14F7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5028-44-0x00000133A1880000-0x00000133A189C000-memory.dmp

Download

memory/5028-37-0x00000133A1850000-0x00000133A185A000-memory.dmp

Download

memory/5028-36-0x00000133A1790000-0x00000133A1843000-memory.dmp

Download

memory/5028-45-0x00000133A1860000-0x00000133A186A000-memory.dmp

Download

memory/5028-52-0x00000133A1B20000-0x00000133A1B3A000-memory.dmp

Download

memory/5028-53-0x00000133A1870000-0x00000133A1878000-memory.dmp

Download

memory/5028-54-0x00000133A1B00000-0x00000133A1B06000-memory.dmp

Download

memory/5028-55-0x00000133A1B10000-0x00000133A1B1A000-memory.dmp

Download

memory/5028-35-0x00000133A1770000-0x00000133A178C000-memory.dmp

Download

memory/5028-25-0x00000133A14C0000-0x00000133A14E2000-memory.dmp

Download