532a32ee98a20db417bc351685933d30edc53b1fe8d10fc7303df6636574dd9e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_2c553ca8ba783feb1fca0f651d268716_icedid_njrat_stealc.exe
Size 6.9MB
Sample260527-tyv2facv3k
SHA256 532a32ee98a20db417bc351685933d30edc53b1fe8d10fc7303df6636574dd9e
MD5 2c553ca8ba783feb1fca0f651d268716
SHA1 14779333a80688c8ee25056aa4aa916a2269b852
SHA512 606bc40bc2775ae4b23d4a53a27eac5632068eb28b2db28f528bbccedc3fc0c84f38ae771042acbac6560bdd251440f552bddc54f07e71248610a9381356fa53
SSDEEP 196608:M+hBtOkvxByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C4:btO8NSG/lVrl3KExL3JzATzC4
TLSH
T1CE76012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5468	powershell.exe
5988	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5940	PeerService.exe
2892	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
2648	tasklist.exe
5264	tasklist.exe
3648	tasklist.exe
4944	tasklist.exe
3828	tasklist.exe
1844	tasklist.exe
1260	tasklist.exe
3452	tasklist.exe
2876	tasklist.exe
808	tasklist.exe
5236	tasklist.exe
1996	tasklist.exe
5208	tasklist.exe
4060	tasklist.exe
4156	tasklist.exe
1640	tasklist.exe
3024	tasklist.exe
2536	tasklist.exe
4644	tasklist.exe
5948	tasklist.exe
5800	tasklist.exe
4572	tasklist.exe
3980	tasklist.exe
4172	tasklist.exe
4460	tasklist.exe
2416	tasklist.exe
5796	tasklist.exe
5660	tasklist.exe
4976	tasklist.exe
6068	tasklist.exe
236	tasklist.exe
4536	tasklist.exe
4432	tasklist.exe
1720	tasklist.exe
2824	tasklist.exe
5100	tasklist.exe
4588	tasklist.exe
2600	tasklist.exe
2196	tasklist.exe
4612	tasklist.exe
4604	tasklist.exe
968	tasklist.exe
2016	tasklist.exe
4172	tasklist.exe
1212	tasklist.exe
272	tasklist.exe
5668	tasklist.exe
1916	tasklist.exe
3888	tasklist.exe
3364	tasklist.exe
2492	tasklist.exe
5864	tasklist.exe
3720	tasklist.exe
4196	tasklist.exe
4160	tasklist.exe
4640	tasklist.exe
5612	tasklist.exe
3364	tasklist.exe
5408	tasklist.exe
1896	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
4828	timeout.exe
1236	timeout.exe
4952	timeout.exe
3584	timeout.exe
1788	timeout.exe
3412	timeout.exe
1596	timeout.exe
5688	timeout.exe
2504	timeout.exe
3716	timeout.exe
4932	timeout.exe
4164	timeout.exe
5204	timeout.exe
4996	timeout.exe
5340	timeout.exe
1760	timeout.exe
5492	timeout.exe
3116	timeout.exe
2336	timeout.exe
3324	timeout.exe
2068	timeout.exe
3952	timeout.exe
276	timeout.exe
3156	timeout.exe
5956	timeout.exe
3116	timeout.exe
1704	timeout.exe
2984	timeout.exe
2472	timeout.exe
2264	timeout.exe
2868	timeout.exe
5464	timeout.exe
3332	timeout.exe
432	timeout.exe
1348	timeout.exe
3964	timeout.exe
5260	timeout.exe
2488	timeout.exe
560	timeout.exe
4208	timeout.exe
3388	timeout.exe
5276	timeout.exe
812	timeout.exe
5600	timeout.exe
4004	timeout.exe
3268	timeout.exe
5684	timeout.exe
2712	timeout.exe
1204	timeout.exe
5424	timeout.exe
5720	timeout.exe
2484	timeout.exe
5696	timeout.exe
4844	timeout.exe
1092	timeout.exe
3544	timeout.exe
1940	timeout.exe
4756	timeout.exe
4992	timeout.exe
2348	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5988	powershell.exe
5988	powershell.exe
5468	powershell.exe
5468	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	5948	tasklist.exe
Token: SeDebugPrivilege	5468	powershell.exe
Token: SeDebugPrivilege	5668	tasklist.exe
Token: SeDebugPrivilege	3888	tasklist.exe
Token: SeDebugPrivilege	3828	tasklist.exe
Token: SeDebugPrivilege	968	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	1844	tasklist.exe
Token: SeDebugPrivilege	4536	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	5796	tasklist.exe
Token: SeDebugPrivilege	1260	tasklist.exe
Token: SeDebugPrivilege	1212	tasklist.exe
Token: SeDebugPrivilege	272	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	5800	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	3720	tasklist.exe
Token: SeDebugPrivilege	1720	tasklist.exe
Token: SeDebugPrivilege	3452	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	5660	tasklist.exe
Token: SeDebugPrivilege	3980	tasklist.exe
Token: SeDebugPrivilege	4976	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	2876	tasklist.exe
Token: SeDebugPrivilege	1916	tasklist.exe
Token: SeDebugPrivilege	5236	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	1996	tasklist.exe
Token: SeDebugPrivilege	2648	tasklist.exe
Token: SeDebugPrivilege	4156	tasklist.exe
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	5208	tasklist.exe
Token: SeDebugPrivilege	4196	tasklist.exe
Token: SeDebugPrivilege	1640	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	2536	tasklist.exe
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	5264	tasklist.exe
Token: SeDebugPrivilege	6068	tasklist.exe
Token: SeDebugPrivilege	5100	tasklist.exe
Token: SeDebugPrivilege	236	tasklist.exe
Token: SeDebugPrivilege	5864	tasklist.exe
Token: SeDebugPrivilege	3648	tasklist.exe
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	5612	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	4060	tasklist.exe
Token: SeDebugPrivilege	4460	tasklist.exe
Token: SeDebugPrivilege	4588	tasklist.exe
Token: SeDebugPrivilege	4432	tasklist.exe
Token: SeDebugPrivilege	4160	tasklist.exe
Token: SeDebugPrivilege	2600	tasklist.exe
Token: SeDebugPrivilege	5408	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4524	2512	2026-05-27_2c553ca8ba783feb1fca0f651d268716_icedid_njrat_stealc.exe	80
PID 4524 wrote to memory of 6008	4524	cmd.exe	82
PID 2512 wrote to memory of 5940	2512	2026-05-27_2c553ca8ba783feb1fca0f651d268716_icedid_njrat_stealc.exe	83
PID 5940 wrote to memory of 5176	5940	PeerService.exe	86
PID 5940 wrote to memory of 1628	5940	PeerService.exe	87
PID 5176 wrote to memory of 5988	5176	cmd.exe	91
PID 2892 wrote to memory of 5080	2892	PeerService.exe	93
PID 2892 wrote to memory of 5568	2892	PeerService.exe	95
PID 1628 wrote to memory of 5948	1628	cmd.exe	97
PID 1628 wrote to memory of 1652	1628	cmd.exe	98
PID 5080 wrote to memory of 5468	5080	cmd.exe	100
PID 5568 wrote to memory of 5668	5568	cmd.exe	101
PID 5568 wrote to memory of 4372	5568	cmd.exe	102
PID 1628 wrote to memory of 3324	1628	cmd.exe	103
PID 5568 wrote to memory of 5688	5568	cmd.exe	104
PID 5568 wrote to memory of 3888	5568	cmd.exe	105
PID 5568 wrote to memory of 4512	5568	cmd.exe	106
PID 1628 wrote to memory of 3828	1628	cmd.exe	107
PID 1628 wrote to memory of 3892	1628	cmd.exe	108
PID 5568 wrote to memory of 4996	5568	cmd.exe	109
PID 1628 wrote to memory of 2264	1628	cmd.exe	110
PID 1628 wrote to memory of 968	1628	cmd.exe	111
PID 1628 wrote to memory of 2828	1628	cmd.exe	112
PID 5568 wrote to memory of 2196	5568	cmd.exe	113
PID 5568 wrote to memory of 1208	5568	cmd.exe	114
PID 5568 wrote to memory of 2712	5568	cmd.exe	115
PID 1628 wrote to memory of 2348	1628	cmd.exe	116
PID 1628 wrote to memory of 1844	1628	cmd.exe	117
PID 1628 wrote to memory of 5124	1628	cmd.exe	118
PID 5568 wrote to memory of 4536	5568	cmd.exe	119
PID 5568 wrote to memory of 1732	5568	cmd.exe	120
PID 1628 wrote to memory of 2868	1628	cmd.exe	121
PID 5568 wrote to memory of 1348	5568	cmd.exe	122
PID 5568 wrote to memory of 4612	5568	cmd.exe	123
PID 5568 wrote to memory of 5808	5568	cmd.exe	124
PID 1628 wrote to memory of 5796	1628	cmd.exe	125
PID 1628 wrote to memory of 3820	1628	cmd.exe	126
PID 5568 wrote to memory of 4952	5568	cmd.exe	127
PID 1628 wrote to memory of 3412	1628	cmd.exe	128
PID 1628 wrote to memory of 1260	1628	cmd.exe	129
PID 1628 wrote to memory of 4796	1628	cmd.exe	130
PID 5568 wrote to memory of 1212	5568	cmd.exe	131
PID 5568 wrote to memory of 1428	5568	cmd.exe	132
PID 1628 wrote to memory of 4828	1628	cmd.exe	133
PID 5568 wrote to memory of 5424	5568	cmd.exe	134
PID 1628 wrote to memory of 272	1628	cmd.exe	135
PID 1628 wrote to memory of 104	1628	cmd.exe	136
PID 5568 wrote to memory of 4944	5568	cmd.exe	137
PID 5568 wrote to memory of 5560	5568	cmd.exe	138
PID 1628 wrote to memory of 5464	1628	cmd.exe	139
PID 5568 wrote to memory of 2068	5568	cmd.exe	140
PID 1628 wrote to memory of 5800	1628	cmd.exe	141
PID 1628 wrote to memory of 4396	1628	cmd.exe	142
PID 5568 wrote to memory of 808	5568	cmd.exe	143
PID 5568 wrote to memory of 6028	5568	cmd.exe	144
PID 1628 wrote to memory of 5600	1628	cmd.exe	145
PID 5568 wrote to memory of 2504	5568	cmd.exe	146
PID 5568 wrote to memory of 3720	5568	cmd.exe	147
PID 5568 wrote to memory of 4604	5568	cmd.exe	148
PID 1628 wrote to memory of 1720	1628	cmd.exe	149
PID 1628 wrote to memory of 1500	1628	cmd.exe	150
PID 5568 wrote to memory of 5720	5568	cmd.exe	151
PID 1628 wrote to memory of 3116	1628	cmd.exe	152
PID 1628 wrote to memory of 3452	1628	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-27_2c553ca8ba783feb1fca0f651d268716_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_2c553ca8ba783feb1fca0f651d268716_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6008
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1652
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3892
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:968
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2828
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5796
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1260
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:272
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:104
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2488
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5260
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1940
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4580
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5208
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3592
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3424
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4120
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5864
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4644
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4604
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4840
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3156
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4596
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2336
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4160
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:812

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5468
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5688
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4512
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4996
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2712
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1348
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5808
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5424
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2068
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4604
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5728
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4068
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2376
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4856
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3388
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:560
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1148
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5648
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3584
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3920
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5728
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5440
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4928
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jirweter.rus.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jirweter.rus.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 11.7MB
SHA256 f79d7be2651963aea1f28e2fc717503df11e8f5b3c334071d9be7fe55c8f849c
MD5 c420559d0c45405dbbd90abf03c61a44
SHA1 0acfa54beaedeb300e208e5d920768e492bedc35
SHA512 1ebe468941a1725db149697bdd0d85a6282e7e53c78cac8d218b65ff31012510ee3e0eb6b13978142402168d980f6534044ac7f0ae6ca7ee9bef414238c5e4df
SSDEEP 196608:M+hBtOkvxByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CoByQyVG/uzGNVyAl3K8fCG7:btO8NSG/lVrl3KExL3JzATzCYNSG/lV3
TLSH
T163C6122BB26901E8E1BBD07CC9165907FBB2780543A097DF16E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5988-50-0x000001BC2DA30000-0x000001BC2DA4C000-memory.dmp

Download

memory/5988-49-0x000001BC2D8B0000-0x000001BC2D8BA000-memory.dmp

Download

memory/5988-42-0x000001BC2D6F0000-0x000001BC2D7A3000-memory.dmp

Download

memory/5988-51-0x000001BC2DA10000-0x000001BC2DA1A000-memory.dmp

Download

memory/5988-52-0x000001BC2DA70000-0x000001BC2DA8A000-memory.dmp

Download

memory/5988-53-0x000001BC2DA20000-0x000001BC2DA28000-memory.dmp

Download

memory/5988-54-0x000001BC2DA50000-0x000001BC2DA56000-memory.dmp

Download

memory/5988-55-0x000001BC2DA60000-0x000001BC2DA6A000-memory.dmp

Download

memory/5988-41-0x000001BC2D6D0000-0x000001BC2D6EC000-memory.dmp

Download

memory/5988-24-0x000001BC2D420000-0x000001BC2D442000-memory.dmp

Download