79da8c21cbe45c46d225e76ae945013a9bd2c421a856f9727051ca94286f39be

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe
Size 4.9MB
Sample260702-zepcfaev5s
SHA256 79da8c21cbe45c46d225e76ae945013a9bd2c421a856f9727051ca94286f39be
MD5 59d3932b4486a7a750b5c7fe1187623f
SHA1 3d54b3df66fb9b7b3f3fc6bbc07e5dd10dd39921
SHA512 2e48fa82fcd14118c5684f41c4971ae1e233444b31b4cdf4b4ee6c511a0ab83a583d83fc02fdbceab87811892891c001a44e1987798c1cae8938ffdd8723fcb6
SSDEEP 98304:i+hBp75lKkBcFWGoqZ92yVG/uzGNV9HkAVHL/DKmFf1:i+hBtOkSoByQyVG/uzGNVyAl3K8f1
TLSH
T12236E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6980	powershell.exe
2656	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2268	PeerService.exe
2628	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
3260	tasklist.exe
4988	tasklist.exe
6332	tasklist.exe
5412	tasklist.exe
6788	tasklist.exe
5476	tasklist.exe
1272	tasklist.exe
6044	tasklist.exe
892	tasklist.exe
6876	tasklist.exe
1376	tasklist.exe
5780	tasklist.exe
2140	tasklist.exe
3216	tasklist.exe
7064	tasklist.exe
3324	tasklist.exe
5760	tasklist.exe
4092	tasklist.exe
2724	tasklist.exe
4496	tasklist.exe
4660	tasklist.exe
1908	tasklist.exe
3872	tasklist.exe
2456	tasklist.exe
5188	tasklist.exe
2968	tasklist.exe
6116	tasklist.exe
4880	tasklist.exe
1232	tasklist.exe
3448	tasklist.exe
2096	tasklist.exe
296	tasklist.exe
3864	tasklist.exe
2676	tasklist.exe
7024	tasklist.exe
7076	tasklist.exe
1448	tasklist.exe
5620	tasklist.exe
900	tasklist.exe
1600	tasklist.exe
7056	tasklist.exe
2276	tasklist.exe
1380	tasklist.exe
4740	tasklist.exe
7032	tasklist.exe
6556	tasklist.exe
4492	tasklist.exe
6780	tasklist.exe
2104	tasklist.exe
788	tasklist.exe
3420	tasklist.exe
5420	tasklist.exe
6124	tasklist.exe
4648	tasklist.exe
4324	tasklist.exe
4124	tasklist.exe
2732	tasklist.exe
5312	tasklist.exe
3672	tasklist.exe
2176	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2600	timeout.exe
2360	timeout.exe
4800	timeout.exe
5464	timeout.exe
3196	timeout.exe
5984	timeout.exe
4624	timeout.exe
6904	timeout.exe
5688	timeout.exe
5180	timeout.exe
3276	timeout.exe
124	timeout.exe
6776	timeout.exe
3572	timeout.exe
1336	timeout.exe
1832	timeout.exe
928	timeout.exe
120	timeout.exe
5568	timeout.exe
2028	timeout.exe
2044	timeout.exe
2464	timeout.exe
2740	timeout.exe
2392	timeout.exe
2612	timeout.exe
6272	timeout.exe
2772	timeout.exe
7108	timeout.exe
4868	timeout.exe
2488	timeout.exe
4664	timeout.exe
6092	timeout.exe
6776	timeout.exe
1752	timeout.exe
6236	timeout.exe
5268	timeout.exe
4136	timeout.exe
4364	timeout.exe
6296	timeout.exe
5972	timeout.exe
6248	timeout.exe
3140	timeout.exe
1676	timeout.exe
3380	timeout.exe
6252	timeout.exe
5016	timeout.exe
6656	timeout.exe
1196	timeout.exe
5676	timeout.exe
2832	timeout.exe
3428	timeout.exe
2872	timeout.exe
5484	timeout.exe
1316	timeout.exe
6552	timeout.exe
2340	timeout.exe
4696	timeout.exe
2612	timeout.exe
7152	timeout.exe
6316	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6980	powershell.exe
6980	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
6980	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6980	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	3672	tasklist.exe
Token: SeDebugPrivilege	1600	tasklist.exe
Token: SeIncreaseQuotaPrivilege	6980	powershell.exe
Token: SeSecurityPrivilege	6980	powershell.exe
Token: SeTakeOwnershipPrivilege	6980	powershell.exe
Token: SeLoadDriverPrivilege	6980	powershell.exe
Token: SeSystemProfilePrivilege	6980	powershell.exe
Token: SeSystemtimePrivilege	6980	powershell.exe
Token: SeProfSingleProcessPrivilege	6980	powershell.exe
Token: SeIncBasePriorityPrivilege	6980	powershell.exe
Token: SeCreatePagefilePrivilege	6980	powershell.exe
Token: SeBackupPrivilege	6980	powershell.exe
Token: SeRestorePrivilege	6980	powershell.exe
Token: SeShutdownPrivilege	6980	powershell.exe
Token: SeDebugPrivilege	6980	powershell.exe
Token: SeSystemEnvironmentPrivilege	6980	powershell.exe
Token: SeRemoteShutdownPrivilege	6980	powershell.exe
Token: SeUndockPrivilege	6980	powershell.exe
Token: SeManageVolumePrivilege	6980	powershell.exe
Token: 33	6980	powershell.exe
Token: 34	6980	powershell.exe
Token: 35	6980	powershell.exe
Token: 36	6980	powershell.exe
Token: SeIncreaseQuotaPrivilege	2656	powershell.exe
Token: SeSecurityPrivilege	2656	powershell.exe
Token: SeTakeOwnershipPrivilege	2656	powershell.exe
Token: SeLoadDriverPrivilege	2656	powershell.exe
Token: SeSystemProfilePrivilege	2656	powershell.exe
Token: SeSystemtimePrivilege	2656	powershell.exe
Token: SeProfSingleProcessPrivilege	2656	powershell.exe
Token: SeIncBasePriorityPrivilege	2656	powershell.exe
Token: SeCreatePagefilePrivilege	2656	powershell.exe
Token: SeBackupPrivilege	2656	powershell.exe
Token: SeRestorePrivilege	2656	powershell.exe
Token: SeShutdownPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeSystemEnvironmentPrivilege	2656	powershell.exe
Token: SeRemoteShutdownPrivilege	2656	powershell.exe
Token: SeUndockPrivilege	2656	powershell.exe
Token: SeManageVolumePrivilege	2656	powershell.exe
Token: 33	2656	powershell.exe
Token: 34	2656	powershell.exe
Token: 35	2656	powershell.exe
Token: 36	2656	powershell.exe
Token: SeDebugPrivilege	1272	tasklist.exe
Token: SeDebugPrivilege	2140	tasklist.exe
Token: SeDebugPrivilege	4324	tasklist.exe
Token: SeDebugPrivilege	788	tasklist.exe
Token: SeDebugPrivilege	7056	tasklist.exe
Token: SeDebugPrivilege	3420	tasklist.exe
Token: SeDebugPrivilege	2276	tasklist.exe
Token: SeDebugPrivilege	4124	tasklist.exe
Token: SeDebugPrivilege	5412	tasklist.exe
Token: SeDebugPrivilege	5420	tasklist.exe
Token: SeDebugPrivilege	3216	tasklist.exe
Token: SeDebugPrivilege	1908	tasklist.exe
Token: SeDebugPrivilege	3324	tasklist.exe
Token: SeDebugPrivilege	4880	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	6044	tasklist.exe
Token: SeDebugPrivilege	7064	tasklist.exe
Token: SeDebugPrivilege	7024	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 6176	4196	2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe	90
PID 6176 wrote to memory of 6344	6176	cmd.exe	92
PID 4196 wrote to memory of 2268	4196	2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe	95
PID 2628 wrote to memory of 3384	2628	PeerService.exe	97
PID 2628 wrote to memory of 2816	2628	PeerService.exe	99
PID 2268 wrote to memory of 1576	2268	PeerService.exe	101
PID 3384 wrote to memory of 6980	3384	cmd.exe	104
PID 2268 wrote to memory of 7048	2268	PeerService.exe	105
PID 1576 wrote to memory of 2656	1576	cmd.exe	107
PID 7048 wrote to memory of 3672	7048	cmd.exe	108
PID 7048 wrote to memory of 5824	7048	cmd.exe	109
PID 2816 wrote to memory of 1600	2816	cmd.exe	110
PID 2816 wrote to memory of 4652	2816	cmd.exe	111
PID 2816 wrote to memory of 6252	2816	cmd.exe	114
PID 7048 wrote to memory of 928	7048	cmd.exe	115
PID 7048 wrote to memory of 1272	7048	cmd.exe	116
PID 7048 wrote to memory of 1844	7048	cmd.exe	117
PID 2816 wrote to memory of 2140	2816	cmd.exe	118
PID 2816 wrote to memory of 6584	2816	cmd.exe	119
PID 7048 wrote to memory of 5016	7048	cmd.exe	120
PID 2816 wrote to memory of 2600	2816	cmd.exe	121
PID 2816 wrote to memory of 4324	2816	cmd.exe	122
PID 2816 wrote to memory of 3356	2816	cmd.exe	123
PID 7048 wrote to memory of 788	7048	cmd.exe	124
PID 7048 wrote to memory of 1184	7048	cmd.exe	125
PID 2816 wrote to memory of 1752	2816	cmd.exe	126
PID 7048 wrote to memory of 4136	7048	cmd.exe	127
PID 2816 wrote to memory of 7056	2816	cmd.exe	128
PID 2816 wrote to memory of 2672	2816	cmd.exe	129
PID 7048 wrote to memory of 3420	7048	cmd.exe	130
PID 7048 wrote to memory of 3280	7048	cmd.exe	131
PID 2816 wrote to memory of 6552	2816	cmd.exe	132
PID 7048 wrote to memory of 3140	7048	cmd.exe	133
PID 7048 wrote to memory of 2276	7048	cmd.exe	134
PID 7048 wrote to memory of 1680	7048	cmd.exe	135
PID 2816 wrote to memory of 4124	2816	cmd.exe	136
PID 2816 wrote to memory of 3892	2816	cmd.exe	137
PID 2816 wrote to memory of 120	2816	cmd.exe	138
PID 7048 wrote to memory of 5464	7048	cmd.exe	139
PID 2816 wrote to memory of 5412	2816	cmd.exe	140
PID 2816 wrote to memory of 52	2816	cmd.exe	141
PID 7048 wrote to memory of 5420	7048	cmd.exe	142
PID 7048 wrote to memory of 1196	7048	cmd.exe	143
PID 7048 wrote to memory of 4364	7048	cmd.exe	144
PID 2816 wrote to memory of 1676	2816	cmd.exe	145
PID 7048 wrote to memory of 3216	7048	cmd.exe	147
PID 7048 wrote to memory of 2932	7048	cmd.exe	148
PID 2816 wrote to memory of 1908	2816	cmd.exe	149
PID 2816 wrote to memory of 7148	2816	cmd.exe	150
PID 7048 wrote to memory of 5688	7048	cmd.exe	151
PID 2816 wrote to memory of 6776	2816	cmd.exe	152
PID 7048 wrote to memory of 3324	7048	cmd.exe	153
PID 7048 wrote to memory of 3732	7048	cmd.exe	154
PID 2816 wrote to memory of 4880	2816	cmd.exe	155
PID 2816 wrote to memory of 3392	2816	cmd.exe	156
PID 7048 wrote to memory of 3196	7048	cmd.exe	157
PID 2816 wrote to memory of 4696	2816	cmd.exe	158
PID 2816 wrote to memory of 1380	2816	cmd.exe	159
PID 2816 wrote to memory of 6576	2816	cmd.exe	160
PID 7048 wrote to memory of 6044	7048	cmd.exe	161
PID 7048 wrote to memory of 3016	7048	cmd.exe	162
PID 2816 wrote to memory of 2612	2816	cmd.exe	163
PID 7048 wrote to memory of 5568	7048	cmd.exe	164
PID 7048 wrote to memory of 7064	7048	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_59d3932b4486a7a750b5c7fe1187623f_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6176
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6344
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3672
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1272
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:788
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3420
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2276
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5420
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3216
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2932
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3324
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3732
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:7064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6968
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:892
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5004
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6848
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6788
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3188
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6804
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4092
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4388
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2488
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2724
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5364
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1376
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4128
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3864
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:7020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5596
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2968
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:7152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6332
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5312
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5580
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5676
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1316

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\System32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6980
- C:\Windows\System32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4652
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6252
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6584
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2600
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3356
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1752
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7056
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2672
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6552
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3892
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:120
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:52
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1676
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:7148
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6776
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3392
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4696
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6576
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2612
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7024
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2248
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1336
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6124
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2876
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2360
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3260
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5312
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5180
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1232
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4580
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5984
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:900
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3972
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2028
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3872
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6980
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4664
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4492
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:948
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4868
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7076
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3660
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2464
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2096
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2172
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4624
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2732
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1248
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2340
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2456
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1784
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6092
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:296
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:424
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1196
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5476
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:692
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6236
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5188
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3388
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2740
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4496
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6012
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6776
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2676
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4436
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5972
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6116
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1224
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:7108
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5620
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1400
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6316
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1448
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3852
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6904
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2104
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5004
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6248
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4660
- - C:\Windows\System32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4788
- - C:\Windows\System32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d30aj42t.5zn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d30aj42t.5zn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.5MB
SHA256 c2a71cfe3adf857d920c221116e4a143e7b94c278a31d17a2de18dbcb8a62b65
MD5 36c4bc1bed3ee4375edff36df5d5ef41
SHA1 56526692c486d8ba7f200831a5f5acf3d76ef877
SHA512 fad9c13d643483f76ec8167c9856608a728d5a2b030d3f5f22744fa2b86c34ec443250058000b04327e4983f3845d9b29d6b2a9747a66bf7d2876ab7f5aaa4df
SSDEEP 196608:i+hBtOkSUByQyVG/uzGNVyAl3K8fCGnbP3JzATC47:ltOQNSG/lVrl3KExL3JzATz7
TLSH
T14066012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-36-0x0000013C68520000-0x0000013C6853E000-memory.dmp

Download

memory/2656-38-0x0000013C68790000-0x0000013C68842000-memory.dmp

Download

memory/6980-17-0x000001C16D0C0000-0x000001C16D0E2000-memory.dmp

Download

memory/6980-39-0x000001C16D550000-0x000001C16D55A000-memory.dmp

Download