efaf3b22327b26e108db66ff162bd91421d32aa81c24cd2e0dee8f13aba922c8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_7dce97d34390fd3458edacfa61ec4232_icedid_njrat_stealc.exe
Size 4.8MB
Sample260601-p6f52aey2n
SHA256 efaf3b22327b26e108db66ff162bd91421d32aa81c24cd2e0dee8f13aba922c8
MD5 7dce97d34390fd3458edacfa61ec4232
SHA1 db0c7c48d9011896100a4da70eba2ab54347d8fa
SHA512 b4e2970af85d2491b4d744bf02e34e94806ab8edd8873e7daded920bd53b3cdc00860d16cfe7c57bc4abddd1a280e79c609e36325cc2a7c4fbe903a92dbd4eb4
SSDEEP 98304:s+hBp75lKkBcxWGoqZ92yVG/uzGNV9HkAVHL/DKmFK:s+hBtOkSsByQyVG/uzGNVyAl3K8K
TLSH
T1BA36E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1896	powershell.exe
3744	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5096	PeerService.exe
4836	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
3044	tasklist.exe
2988	tasklist.exe
332	tasklist.exe
1388	tasklist.exe
2692	tasklist.exe
1540	tasklist.exe
4080	tasklist.exe
4552	tasklist.exe
2688	tasklist.exe
2880	tasklist.exe
3720	tasklist.exe
1956	tasklist.exe
680	tasklist.exe
4056	tasklist.exe
4604	tasklist.exe
104	tasklist.exe
1400	tasklist.exe
788	tasklist.exe
1172	tasklist.exe
388	tasklist.exe
2128	tasklist.exe
3136	tasklist.exe
1256	tasklist.exe
4464	tasklist.exe
3292	tasklist.exe
4756	tasklist.exe
3120	tasklist.exe
1436	tasklist.exe
1528	tasklist.exe
4104	tasklist.exe
1888	tasklist.exe
2512	tasklist.exe
1768	tasklist.exe
2252	tasklist.exe
1756	tasklist.exe
3244	tasklist.exe
2392	tasklist.exe
1116	tasklist.exe
3880	tasklist.exe
1924	tasklist.exe
2444	tasklist.exe
1668	tasklist.exe
4448	tasklist.exe
2136	tasklist.exe
1528	tasklist.exe
3252	tasklist.exe
916	tasklist.exe
4072	tasklist.exe
1152	tasklist.exe
1056	tasklist.exe
4644	tasklist.exe
3144	tasklist.exe
2096	tasklist.exe
1996	tasklist.exe
1692	tasklist.exe
5072	tasklist.exe
1208	tasklist.exe
2260	tasklist.exe
2424	tasklist.exe
2880	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2616	timeout.exe
1628	timeout.exe
3480	timeout.exe
1736	timeout.exe
2260	timeout.exe
2036	timeout.exe
4536	timeout.exe
240	timeout.exe
2100	timeout.exe
1692	timeout.exe
1636	timeout.exe
800	timeout.exe
2192	timeout.exe
5080	timeout.exe
540	timeout.exe
3752	timeout.exe
4692	timeout.exe
820	timeout.exe
2976	timeout.exe
1832	timeout.exe
2164	timeout.exe
1748	timeout.exe
3512	timeout.exe
4008	timeout.exe
2688	timeout.exe
4268	timeout.exe
556	timeout.exe
4252	timeout.exe
1208	timeout.exe
1204	timeout.exe
1392	timeout.exe
2976	timeout.exe
2412	timeout.exe
4088	timeout.exe
4644	timeout.exe
2416	timeout.exe
1164	timeout.exe
2616	timeout.exe
680	timeout.exe
1608	timeout.exe
272	timeout.exe
1884	timeout.exe
5036	timeout.exe
2472	timeout.exe
1912	timeout.exe
3320	timeout.exe
4204	timeout.exe
1116	timeout.exe
1640	timeout.exe
2616	timeout.exe
2384	timeout.exe
4360	timeout.exe
3896	timeout.exe
3152	timeout.exe
2468	timeout.exe
1080	timeout.exe
2200	timeout.exe
1220	timeout.exe
4112	timeout.exe
808	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1896	powershell.exe
1896	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	3720	tasklist.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	1956	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	1152	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	1208	tasklist.exe
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	1924	tasklist.exe
Token: SeDebugPrivilege	680	tasklist.exe
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	2136	tasklist.exe
Token: SeDebugPrivilege	2880	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	788	tasklist.exe
Token: SeDebugPrivilege	104	tasklist.exe
Token: SeDebugPrivilege	332	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeDebugPrivilege	4056	tasklist.exe
Token: SeDebugPrivilege	1172	tasklist.exe
Token: SeDebugPrivilege	2252	tasklist.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	388	tasklist.exe
Token: SeDebugPrivilege	1388	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	3292	tasklist.exe
Token: SeDebugPrivilege	2692	tasklist.exe
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	2392	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	2688	tasklist.exe
Token: SeDebugPrivilege	1116	tasklist.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	1768	tasklist.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	1996	tasklist.exe
Token: SeDebugPrivilege	3120	tasklist.exe
Token: SeDebugPrivilege	3880	tasklist.exe
Token: SeDebugPrivilege	2988	tasklist.exe
Token: SeDebugPrivilege	3136	tasklist.exe
Token: SeDebugPrivilege	4080	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	1400	tasklist.exe
Token: SeDebugPrivilege	4072	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	2880	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	1256	tasklist.exe
Token: SeDebugPrivilege	4448	tasklist.exe
Token: SeDebugPrivilege	5072	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2464	1248	2026-06-01_7dce97d34390fd3458edacfa61ec4232_icedid_njrat_stealc.exe	81
PID 2464 wrote to memory of 916	2464	cmd.exe	83
PID 1248 wrote to memory of 5096	1248	2026-06-01_7dce97d34390fd3458edacfa61ec4232_icedid_njrat_stealc.exe	84
PID 5096 wrote to memory of 4340	5096	PeerService.exe	87
PID 5096 wrote to memory of 4308	5096	PeerService.exe	89
PID 4340 wrote to memory of 1896	4340	cmd.exe	91
PID 4308 wrote to memory of 4552	4308	cmd.exe	94
PID 4308 wrote to memory of 2368	4308	cmd.exe	95
PID 4836 wrote to memory of 5100	4836	PeerService.exe	96
PID 4836 wrote to memory of 2168	4836	PeerService.exe	97
PID 5100 wrote to memory of 3744	5100	cmd.exe	101
PID 2168 wrote to memory of 3720	2168	cmd.exe	102
PID 2168 wrote to memory of 272	2168	cmd.exe	103
PID 2168 wrote to memory of 1116	2168	cmd.exe	104
PID 4308 wrote to memory of 1220	4308	cmd.exe	105
PID 4308 wrote to memory of 1956	4308	cmd.exe	106
PID 4308 wrote to memory of 3568	4308	cmd.exe	107
PID 2168 wrote to memory of 2424	2168	cmd.exe	108
PID 2168 wrote to memory of 4888	2168	cmd.exe	109
PID 4308 wrote to memory of 2200	4308	cmd.exe	110
PID 2168 wrote to memory of 2616	2168	cmd.exe	111
PID 2168 wrote to memory of 1152	2168	cmd.exe	112
PID 2168 wrote to memory of 3144	2168	cmd.exe	113
PID 4308 wrote to memory of 1756	4308	cmd.exe	114
PID 4308 wrote to memory of 3400	4308	cmd.exe	115
PID 2168 wrote to memory of 1636	2168	cmd.exe	116
PID 4308 wrote to memory of 3512	4308	cmd.exe	117
PID 2168 wrote to memory of 3244	2168	cmd.exe	118
PID 2168 wrote to memory of 3848	2168	cmd.exe	119
PID 4308 wrote to memory of 1208	4308	cmd.exe	120
PID 4308 wrote to memory of 3240	4308	cmd.exe	121
PID 2168 wrote to memory of 1204	2168	cmd.exe	122
PID 4308 wrote to memory of 800	4308	cmd.exe	123
PID 2168 wrote to memory of 4604	2168	cmd.exe	124
PID 2168 wrote to memory of 4620	2168	cmd.exe	125
PID 4308 wrote to memory of 3044	4308	cmd.exe	126
PID 4308 wrote to memory of 2824	4308	cmd.exe	127
PID 2168 wrote to memory of 1640	2168	cmd.exe	128
PID 4308 wrote to memory of 3480	4308	cmd.exe	129
PID 4308 wrote to memory of 1924	4308	cmd.exe	130
PID 4308 wrote to memory of 3832	4308	cmd.exe	131
PID 2168 wrote to memory of 680	2168	cmd.exe	132
PID 2168 wrote to memory of 1612	2168	cmd.exe	133
PID 4308 wrote to memory of 4112	4308	cmd.exe	134
PID 2168 wrote to memory of 1164	2168	cmd.exe	135
PID 2168 wrote to memory of 4464	2168	cmd.exe	136
PID 2168 wrote to memory of 328	2168	cmd.exe	137
PID 4308 wrote to memory of 2136	4308	cmd.exe	138
PID 4308 wrote to memory of 2516	4308	cmd.exe	139
PID 2168 wrote to memory of 1692	2168	cmd.exe	140
PID 4308 wrote to memory of 1736	4308	cmd.exe	141
PID 4308 wrote to memory of 2880	4308	cmd.exe	142
PID 4308 wrote to memory of 5068	4308	cmd.exe	143
PID 2168 wrote to memory of 1528	2168	cmd.exe	144
PID 2168 wrote to memory of 2572	2168	cmd.exe	145
PID 4308 wrote to memory of 1912	4308	cmd.exe	146
PID 2168 wrote to memory of 1392	2168	cmd.exe	147
PID 4308 wrote to memory of 4104	4308	cmd.exe	148
PID 4308 wrote to memory of 2512	4308	cmd.exe	149
PID 2168 wrote to memory of 788	2168	cmd.exe	150
PID 2168 wrote to memory of 2392	2168	cmd.exe	151
PID 4308 wrote to memory of 1628	4308	cmd.exe	152
PID 2168 wrote to memory of 4008	2168	cmd.exe	153
PID 2168 wrote to memory of 332	2168	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-01_7dce97d34390fd3458edacfa61ec4232_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_7dce97d34390fd3458edacfa61ec4232_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:916
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4552
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1956
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3568
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2200
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3400
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1208
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3240
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3832
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2136
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2880
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2512
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3688
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1956
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1144
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3880
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1888
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:800
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3480
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3048
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2096
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1736
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2392
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1768
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:784
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2384
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3880
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4668
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4080
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1684
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2100

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2616
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3144
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3848
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4620
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1612
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2696
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2616
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3024
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3320
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4876
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4604
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:680
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4804
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3376
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2616
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1884
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1924
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ceceebdbd877d161f925e88d1983f280ddd0d9f053aedb0933a4ce9b0e87d56e
MD5 74b36cdea857534f335ca01cf989c95d
SHA1 17e64556a910c99db09300818cf3244a0ffd0fc9
SHA512 a608fb113e4a11c2a5ace3fe9f5e589bfae960b2fba4fa10c9ca0ab7453e3d8cbbd62b0a9a42ee43154ab359aafdb68e3c3445d7f7e7a1531152bab96366bfae
TLSH
T1A6218633B7ACC235C8D911BA208CAD11B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kptd4lkp.keq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kptd4lkp.keq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.8MB
SHA256 c251eccee8bba08d2fad359dcf885f19aa221b5800e989bf11fa03bb8d654128
MD5 7754143f2547635035587a08d1cb71b5
SHA1 7fa377e37c2ff10646b17573cf70cc65a775e602
SHA512 9524c70f752b8847e10845891a5f2c2fbeddc39c90d4caad44d0ea208c5aca1e4b8ea908b1a63cfd4e9f765c0b0ec20398a407ba87927e41129da14bb96f81ec
SSDEEP 196608:s+hBtOkSsByQyVG/uzGNVyAl3K8mByQyVG/uzGNVyAl3K8fCG/:7tO4NSG/lVrl3KDNSG/lVrl3KEt
TLSH
T1E886016BB26901E8D1BFD17CC9065907EBB2780543A0A6CF12E046A62F77BE14F7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-50-0x000001E9A1F90000-0x000001E9A1FAC000-memory.dmp

Download

memory/1896-43-0x000001E9A1C00000-0x000001E9A1C0A000-memory.dmp

Download

memory/1896-42-0x000001E9A1B40000-0x000001E9A1BF3000-memory.dmp

Download

memory/1896-51-0x000001E9A1F70000-0x000001E9A1F7A000-memory.dmp

Download

memory/1896-52-0x000001E9A20D0000-0x000001E9A20EA000-memory.dmp

Download

memory/1896-53-0x000001E9A1F80000-0x000001E9A1F88000-memory.dmp

Download

memory/1896-54-0x000001E9A20B0000-0x000001E9A20B6000-memory.dmp

Download

memory/1896-55-0x000001E9A20C0000-0x000001E9A20CA000-memory.dmp

Download

memory/1896-35-0x000001E9A1B20000-0x000001E9A1B3C000-memory.dmp

Download

memory/1896-26-0x000001E9A1A80000-0x000001E9A1AA2000-memory.dmp

Download