c8dcf43d1f26b324b4a89f1feea30a216cd1267aac4cab763b8ffbda337a790c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe
Size 5.7MB
Sample260628-3lencsht7l
SHA256 c8dcf43d1f26b324b4a89f1feea30a216cd1267aac4cab763b8ffbda337a790c
MD5 2dd0182930d515d3d1043c5b1c41168d
SHA1 74a09ca968297c9d5417ade5b911927d67be3114
SHA512 3c061ff30f58d018f28d4f6f1024b497cf237fcaa50fc2260a0416c2df1b16c867034a0aace1aa751d178ebb9848b7dc6063a8fa9bbaffdf3b00ad86726c16f9
SSDEEP 98304:s+hBp75lKkBcxWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWN:s+hBtOkSsByQyVG/uzGNVyAl3K8fCGnh
TLSH
T14056F12BB26901E8D1BFD17CC9065907EBB2780503A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3504	powershell.exe
6732	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5968	PeerService.exe
708	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
3292	tasklist.exe
4264	tasklist.exe
6204	tasklist.exe
2128	tasklist.exe
3972	tasklist.exe
3032	tasklist.exe
3024	tasklist.exe
6760	tasklist.exe
4640	tasklist.exe
1008	tasklist.exe
4752	tasklist.exe
2664	tasklist.exe
2532	tasklist.exe
4876	tasklist.exe
6812	tasklist.exe
2524	tasklist.exe
6436	tasklist.exe
3980	tasklist.exe
4816	tasklist.exe
2892	tasklist.exe
4432	tasklist.exe
6972	tasklist.exe
6628	tasklist.exe
6308	tasklist.exe
3160	tasklist.exe
5512	tasklist.exe
4436	tasklist.exe
6336	tasklist.exe
6544	tasklist.exe
2288	tasklist.exe
1784	tasklist.exe
428	tasklist.exe
2032	tasklist.exe
6172	tasklist.exe
5124	tasklist.exe
1876	tasklist.exe
1444	tasklist.exe
6948	tasklist.exe
3196	tasklist.exe
248	tasklist.exe
6456	tasklist.exe
5416	tasklist.exe
5436	tasklist.exe
3264	tasklist.exe
4540	tasklist.exe
1484	tasklist.exe
7148	tasklist.exe
6944	tasklist.exe
1808	tasklist.exe
3660	tasklist.exe
4772	tasklist.exe
5736	tasklist.exe
6508	tasklist.exe
1896	tasklist.exe
6184	tasklist.exe
6488	tasklist.exe
6108	tasklist.exe
1364	tasklist.exe
1796	tasklist.exe
4840	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3880	timeout.exe
5988	timeout.exe
5184	timeout.exe
244	timeout.exe
5104	timeout.exe
4776	timeout.exe
1208	timeout.exe
5852	timeout.exe
6120	timeout.exe
1344	timeout.exe
1380	timeout.exe
1356	timeout.exe
6992	timeout.exe
6360	timeout.exe
3460	timeout.exe
3304	timeout.exe
3144	timeout.exe
700	timeout.exe
7132	timeout.exe
6680	timeout.exe
6600	timeout.exe
1436	timeout.exe
6896	timeout.exe
2468	timeout.exe
1964	timeout.exe
1376	timeout.exe
6632	timeout.exe
6528	timeout.exe
4432	timeout.exe
5728	timeout.exe
1528	timeout.exe
4568	timeout.exe
5188	timeout.exe
2128	timeout.exe
2256	timeout.exe
2876	timeout.exe
4616	timeout.exe
4388	timeout.exe
2612	timeout.exe
264	timeout.exe
4220	timeout.exe
1972	timeout.exe
1464	timeout.exe
5408	timeout.exe
6060	timeout.exe
6268	timeout.exe
2452	timeout.exe
3864	timeout.exe
1640	timeout.exe
2788	timeout.exe
1740	timeout.exe
5872	timeout.exe
3680	timeout.exe
4824	timeout.exe
3856	timeout.exe
2304	timeout.exe
2684	timeout.exe
5260	timeout.exe
2948	timeout.exe
4112	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe
6732	powershell.exe
6732	powershell.exe
6732	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	tasklist.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	4876	tasklist.exe
Token: SeDebugPrivilege	6732	powershell.exe
Token: SeIncreaseQuotaPrivilege	3504	powershell.exe
Token: SeSecurityPrivilege	3504	powershell.exe
Token: SeTakeOwnershipPrivilege	3504	powershell.exe
Token: SeLoadDriverPrivilege	3504	powershell.exe
Token: SeSystemProfilePrivilege	3504	powershell.exe
Token: SeSystemtimePrivilege	3504	powershell.exe
Token: SeProfSingleProcessPrivilege	3504	powershell.exe
Token: SeIncBasePriorityPrivilege	3504	powershell.exe
Token: SeCreatePagefilePrivilege	3504	powershell.exe
Token: SeBackupPrivilege	3504	powershell.exe
Token: SeRestorePrivilege	3504	powershell.exe
Token: SeShutdownPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeSystemEnvironmentPrivilege	3504	powershell.exe
Token: SeRemoteShutdownPrivilege	3504	powershell.exe
Token: SeUndockPrivilege	3504	powershell.exe
Token: SeManageVolumePrivilege	3504	powershell.exe
Token: 33	3504	powershell.exe
Token: 34	3504	powershell.exe
Token: 35	3504	powershell.exe
Token: 36	3504	powershell.exe
Token: SeIncreaseQuotaPrivilege	6732	powershell.exe
Token: SeSecurityPrivilege	6732	powershell.exe
Token: SeTakeOwnershipPrivilege	6732	powershell.exe
Token: SeLoadDriverPrivilege	6732	powershell.exe
Token: SeSystemProfilePrivilege	6732	powershell.exe
Token: SeSystemtimePrivilege	6732	powershell.exe
Token: SeProfSingleProcessPrivilege	6732	powershell.exe
Token: SeIncBasePriorityPrivilege	6732	powershell.exe
Token: SeCreatePagefilePrivilege	6732	powershell.exe
Token: SeBackupPrivilege	6732	powershell.exe
Token: SeRestorePrivilege	6732	powershell.exe
Token: SeShutdownPrivilege	6732	powershell.exe
Token: SeDebugPrivilege	6732	powershell.exe
Token: SeSystemEnvironmentPrivilege	6732	powershell.exe
Token: SeRemoteShutdownPrivilege	6732	powershell.exe
Token: SeUndockPrivilege	6732	powershell.exe
Token: SeManageVolumePrivilege	6732	powershell.exe
Token: 33	6732	powershell.exe
Token: 34	6732	powershell.exe
Token: 35	6732	powershell.exe
Token: 36	6732	powershell.exe
Token: SeDebugPrivilege	3660	tasklist.exe
Token: SeDebugPrivilege	6184	tasklist.exe
Token: SeDebugPrivilege	1008	tasklist.exe
Token: SeDebugPrivilege	6948	tasklist.exe
Token: SeDebugPrivilege	4772	tasklist.exe
Token: SeDebugPrivilege	6308	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	3972	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	3160	tasklist.exe
Token: SeDebugPrivilege	6812	tasklist.exe
Token: SeDebugPrivilege	6204	tasklist.exe
Token: SeDebugPrivilege	1784	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	4540	tasklist.exe
Token: SeDebugPrivilege	428	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	6488	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 5940	5716	2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe	91
PID 5940 wrote to memory of 6064	5940	cmd.exe	93
PID 5716 wrote to memory of 5968	5716	2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe	94
PID 5968 wrote to memory of 948	5968	PeerService.exe	96
PID 5968 wrote to memory of 5764	5968	PeerService.exe	97
PID 948 wrote to memory of 3504	948	cmd.exe	102
PID 5764 wrote to memory of 1444	5764	cmd.exe	103
PID 5764 wrote to memory of 6720	5764	cmd.exe	104
PID 708 wrote to memory of 616	708	PeerService.exe	106
PID 708 wrote to memory of 4444	708	PeerService.exe	107
PID 616 wrote to memory of 6732	616	cmd.exe	110
PID 4444 wrote to memory of 4876	4444	cmd.exe	111
PID 4444 wrote to memory of 6728	4444	cmd.exe	112
PID 5764 wrote to memory of 3880	5764	cmd.exe	115
PID 4444 wrote to memory of 3680	4444	cmd.exe	116
PID 4444 wrote to memory of 3660	4444	cmd.exe	117
PID 4444 wrote to memory of 3628	4444	cmd.exe	118
PID 5764 wrote to memory of 6184	5764	cmd.exe	119
PID 5764 wrote to memory of 5112	5764	cmd.exe	120
PID 4444 wrote to memory of 3304	4444	cmd.exe	121
PID 5764 wrote to memory of 6600	5764	cmd.exe	122
PID 5764 wrote to memory of 1008	5764	cmd.exe	123
PID 5764 wrote to memory of 1844	5764	cmd.exe	124
PID 4444 wrote to memory of 6948	4444	cmd.exe	125
PID 4444 wrote to memory of 2084	4444	cmd.exe	126
PID 5764 wrote to memory of 1964	5764	cmd.exe	127
PID 4444 wrote to memory of 1380	4444	cmd.exe	128
PID 4444 wrote to memory of 4772	4444	cmd.exe	129
PID 4444 wrote to memory of 1328	4444	cmd.exe	130
PID 5764 wrote to memory of 6308	5764	cmd.exe	131
PID 5764 wrote to memory of 6452	5764	cmd.exe	132
PID 4444 wrote to memory of 1436	4444	cmd.exe	133
PID 5764 wrote to memory of 1528	5764	cmd.exe	134
PID 4444 wrote to memory of 2128	4444	cmd.exe	135
PID 4444 wrote to memory of 4244	4444	cmd.exe	136
PID 5764 wrote to memory of 3972	5764	cmd.exe	137
PID 5764 wrote to memory of 3292	5764	cmd.exe	138
PID 4444 wrote to memory of 4568	4444	cmd.exe	139
PID 5764 wrote to memory of 1208	5764	cmd.exe	140
PID 5764 wrote to memory of 2288	5764	cmd.exe	141
PID 5764 wrote to memory of 2924	5764	cmd.exe	142
PID 4444 wrote to memory of 3160	4444	cmd.exe	143
PID 4444 wrote to memory of 4676	4444	cmd.exe	144
PID 5764 wrote to memory of 3144	5764	cmd.exe	145
PID 4444 wrote to memory of 244	4444	cmd.exe	146
PID 5764 wrote to memory of 6812	5764	cmd.exe	147
PID 5764 wrote to memory of 3676	5764	cmd.exe	148
PID 4444 wrote to memory of 6204	4444	cmd.exe	149
PID 4444 wrote to memory of 744	4444	cmd.exe	150
PID 5764 wrote to memory of 4616	5764	cmd.exe	151
PID 4444 wrote to memory of 5188	4444	cmd.exe	152
PID 5764 wrote to memory of 1784	5764	cmd.exe	153
PID 5764 wrote to memory of 2180	5764	cmd.exe	154
PID 4444 wrote to memory of 2524	4444	cmd.exe	155
PID 4444 wrote to memory of 2468	4444	cmd.exe	156
PID 5764 wrote to memory of 1640	5764	cmd.exe	157
PID 4444 wrote to memory of 1376	4444	cmd.exe	158
PID 4444 wrote to memory of 4540	4444	cmd.exe	159
PID 4444 wrote to memory of 6476	4444	cmd.exe	160
PID 5764 wrote to memory of 428	5764	cmd.exe	161
PID 5764 wrote to memory of 2216	5764	cmd.exe	162
PID 4444 wrote to memory of 6632	4444	cmd.exe	163
PID 5764 wrote to memory of 5852	5764	cmd.exe	164
PID 4444 wrote to memory of 2892	4444	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_2dd0182930d515d3d1043c5b1c41168d_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3880
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1008
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6308
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2924
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6812
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3676
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:428
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6488
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3176
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6436
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6268
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6108
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6508
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4932
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1796
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6944
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6620
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2532
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5184
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4616
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6544
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6456
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6972
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5372
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1896
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1908
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3884
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4112

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\System32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6732
- C:\Windows\System32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6728
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3680
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3628
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3304
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6948
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2084
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1380
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1328
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1436
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4244
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4568
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4676
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:244
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6204
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:744
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5188
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2468
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1376
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6476
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6632
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:760
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4220
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6972
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3360
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5104
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3980
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5004
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6528
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5736
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3156
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6060
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4816
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:820
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6120
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6760
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4972
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2684
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4752
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6856
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4824
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7148
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3504
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:700
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4436
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6556
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6896
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2664
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3056
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2612
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3196
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:668
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3856
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3292
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3756
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2256
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6336
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2584
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:264
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:248
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:252
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:7132
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6172
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2156
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2468
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5124
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4628
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2304
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6628
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4220
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6268
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1876
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5104
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2876
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4840
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3956
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1464
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4640
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5432
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3864
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5436
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5736
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fdvljx2e.e3f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdvljx2e.e3f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.9MB
SHA256 64d3e49ea391968ae9a26023eb69929dc3fdbd277f9fde1296905d789a39c721
MD5 e46dbf74bbe52ac44e0d7ee496b10dc2
SHA1 075cb183ee10b1b7055be9ec46440f909c0b20c7
SHA512 55b9b838c02eb46598c038a6ef564a4d422a11f919d292c5f27d72c97ce94fc898bfef79e9f0bda24314bba29edad22e2ec5714771db3124738216b41e193c08
SSDEEP 98304:4+hBp75lKkBc/WGoqZ92yVG/uzGNV9HkAVHL/DKmFX:4+hBtOkS+ByQyVG/uzGNVyAl3K8X
TLSH
T1D736E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3504-14-0x0000027054980000-0x00000270549A2000-memory.dmp

Download

memory/3504-19-0x000002706CFB0000-0x000002706CFCE000-memory.dmp

Download

memory/3504-20-0x000002706D020000-0x000002706D0D2000-memory.dmp

Download

memory/3504-21-0x000002706CFD0000-0x000002706CFDA000-memory.dmp

Download