cac5bf496e92386e10f80eb4cb6f2faae3024c56c60a4cb8299ab73ea4fa299d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe
Size 6.7MB
Sample260729-aw5cjsstew
SHA256 cac5bf496e92386e10f80eb4cb6f2faae3024c56c60a4cb8299ab73ea4fa299d
MD5 aca33936b6e3640351da7b1fd9e4f904
SHA1 63ac8ac84c6ad31c0431b6d68b4ced4696ee06ae
SHA512 47a89724021698e37029f2e8a0c7e0474520706afafe0c69ea1f301be7fd55c180e7c1208aa151254baa2ee299b93e9292199482dbfc6ab0c4d67b93bc2caa62
SSDEEP 196608:e+hBw+kWByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C2:xw+1NSG/lVrl3KExL3JzATzC2
TLSH
T13866016B726901E8E1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5556	powershell.exe
2484	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2880	PeerService.exe
5316	PeerService.exe

Enumerates processes with tasklist 1 TTPs 59 IoCs

discovery

Process Discovery

T1057

pid	Process
5236	tasklist.exe
3168	tasklist.exe
4084	tasklist.exe
1260	tasklist.exe
2224	tasklist.exe
5836	tasklist.exe
1720	tasklist.exe
1368	tasklist.exe
5556	tasklist.exe
1888	tasklist.exe
5144	tasklist.exe
4652	tasklist.exe
5076	tasklist.exe
2792	tasklist.exe
1420	tasklist.exe
3972	tasklist.exe
3340	tasklist.exe
8	tasklist.exe
4524	tasklist.exe
3108	tasklist.exe
3448	tasklist.exe
2840	tasklist.exe
1468	tasklist.exe
4152	tasklist.exe
3664	tasklist.exe
5684	tasklist.exe
4172	tasklist.exe
5840	tasklist.exe
3768	tasklist.exe
4776	tasklist.exe
4432	tasklist.exe
4292	tasklist.exe
4144	tasklist.exe
424	tasklist.exe
2412	tasklist.exe
5396	tasklist.exe
3536	tasklist.exe
3416	tasklist.exe
1304	tasklist.exe
6000	tasklist.exe
4320	tasklist.exe
1228	tasklist.exe
4612	tasklist.exe
1128	tasklist.exe
932	tasklist.exe
3592	tasklist.exe
5384	tasklist.exe
956	tasklist.exe
3260	tasklist.exe
6136	tasklist.exe
4512	tasklist.exe
988	tasklist.exe
5380	tasklist.exe
1164	tasklist.exe
3304	tasklist.exe
5552	tasklist.exe
2276	tasklist.exe
932	tasklist.exe
4272	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe
2896	cmd.exe
1480	cmd.exe
2512	cmd.exe
5604	cmd.exe

Delays execution with timeout.exe 58 IoCs

defense_evasion

pid	Process
2536	timeout.exe
5880	timeout.exe
5248	timeout.exe
5048	timeout.exe
5580	timeout.exe
956	timeout.exe
6076	timeout.exe
1032	timeout.exe
3840	timeout.exe
1724	timeout.exe
2120	timeout.exe
3392	timeout.exe
2812	timeout.exe
2328	timeout.exe
2748	timeout.exe
2496	timeout.exe
2864	timeout.exe
252	timeout.exe
2708	timeout.exe
2452	timeout.exe
5260	timeout.exe
2692	timeout.exe
4776	timeout.exe
5252	timeout.exe
3056	timeout.exe
5184	timeout.exe
2784	timeout.exe
4452	timeout.exe
3760	timeout.exe
3264	timeout.exe
4656	timeout.exe
1192	timeout.exe
5184	timeout.exe
1876	timeout.exe
2184	timeout.exe
2392	timeout.exe
2256	timeout.exe
1936	timeout.exe
4348	timeout.exe
1572	timeout.exe
2604	timeout.exe
1240	timeout.exe
3356	timeout.exe
3232	timeout.exe
1308	timeout.exe
300	timeout.exe
3076	timeout.exe
3944	timeout.exe
1548	timeout.exe
2604	timeout.exe
2820	timeout.exe
1388	timeout.exe
4104	timeout.exe
1032	timeout.exe
1308	timeout.exe
4512	timeout.exe
3236	timeout.exe
4936	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	tasklist.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	4524	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5556	powershell.exe
Token: SeSecurityPrivilege	5556	powershell.exe
Token: SeTakeOwnershipPrivilege	5556	powershell.exe
Token: SeLoadDriverPrivilege	5556	powershell.exe
Token: SeSystemProfilePrivilege	5556	powershell.exe
Token: SeSystemtimePrivilege	5556	powershell.exe
Token: SeProfSingleProcessPrivilege	5556	powershell.exe
Token: SeIncBasePriorityPrivilege	5556	powershell.exe
Token: SeCreatePagefilePrivilege	5556	powershell.exe
Token: SeBackupPrivilege	5556	powershell.exe
Token: SeRestorePrivilege	5556	powershell.exe
Token: SeShutdownPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeSystemEnvironmentPrivilege	5556	powershell.exe
Token: SeRemoteShutdownPrivilege	5556	powershell.exe
Token: SeUndockPrivilege	5556	powershell.exe
Token: SeManageVolumePrivilege	5556	powershell.exe
Token: 33	5556	powershell.exe
Token: 34	5556	powershell.exe
Token: 35	5556	powershell.exe
Token: 36	5556	powershell.exe
Token: SeIncreaseQuotaPrivilege	2484	powershell.exe
Token: SeSecurityPrivilege	2484	powershell.exe
Token: SeTakeOwnershipPrivilege	2484	powershell.exe
Token: SeLoadDriverPrivilege	2484	powershell.exe
Token: SeSystemProfilePrivilege	2484	powershell.exe
Token: SeSystemtimePrivilege	2484	powershell.exe
Token: SeProfSingleProcessPrivilege	2484	powershell.exe
Token: SeIncBasePriorityPrivilege	2484	powershell.exe
Token: SeCreatePagefilePrivilege	2484	powershell.exe
Token: SeBackupPrivilege	2484	powershell.exe
Token: SeRestorePrivilege	2484	powershell.exe
Token: SeShutdownPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeSystemEnvironmentPrivilege	2484	powershell.exe
Token: SeRemoteShutdownPrivilege	2484	powershell.exe
Token: SeUndockPrivilege	2484	powershell.exe
Token: SeManageVolumePrivilege	2484	powershell.exe
Token: 33	2484	powershell.exe
Token: 34	2484	powershell.exe
Token: 35	2484	powershell.exe
Token: 36	2484	powershell.exe
Token: SeDebugPrivilege	1720	tasklist.exe
Token: SeDebugPrivilege	4152	tasklist.exe
Token: SeDebugPrivilege	3592	tasklist.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	2224	tasklist.exe
Token: SeDebugPrivilege	5840	tasklist.exe
Token: SeDebugPrivilege	1368	tasklist.exe
Token: SeDebugPrivilege	4320	tasklist.exe
Token: SeDebugPrivilege	3768	tasklist.exe
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	1228	tasklist.exe
Token: SeDebugPrivilege	3664	tasklist.exe
Token: SeDebugPrivilege	8	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	5556	tasklist.exe
Token: SeDebugPrivilege	5396	tasklist.exe
Token: SeDebugPrivilege	988	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 2896	3388	2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe	90
PID 2896 wrote to memory of 1696	2896	cmd.exe	92
PID 3388 wrote to memory of 2880	3388	2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe	93
PID 2880 wrote to memory of 1480	2880	PeerService.exe	96
PID 2880 wrote to memory of 2512	2880	PeerService.exe	97
PID 2512 wrote to memory of 2412	2512	cmd.exe	100
PID 2512 wrote to memory of 5292	2512	cmd.exe	101
PID 1480 wrote to memory of 5556	1480	cmd.exe	104
PID 5316 wrote to memory of 5604	5316	PeerService.exe	105
PID 5316 wrote to memory of 2100	5316	PeerService.exe	106
PID 5604 wrote to memory of 2484	5604	cmd.exe	109
PID 2100 wrote to memory of 4524	2100	cmd.exe	110
PID 2100 wrote to memory of 1212	2100	cmd.exe	111
PID 2100 wrote to memory of 2536	2100	cmd.exe	114
PID 2512 wrote to memory of 3264	2512	cmd.exe	115
PID 2100 wrote to memory of 1720	2100	cmd.exe	116
PID 2100 wrote to memory of 3040	2100	cmd.exe	117
PID 2100 wrote to memory of 2864	2100	cmd.exe	118
PID 2512 wrote to memory of 4152	2512	cmd.exe	119
PID 2512 wrote to memory of 4984	2512	cmd.exe	120
PID 2512 wrote to memory of 2812	2512	cmd.exe	121
PID 2100 wrote to memory of 3592	2100	cmd.exe	122
PID 2100 wrote to memory of 4652	2100	cmd.exe	123
PID 2100 wrote to memory of 3232	2100	cmd.exe	124
PID 2512 wrote to memory of 4512	2512	cmd.exe	125
PID 2512 wrote to memory of 4668	2512	cmd.exe	126
PID 2512 wrote to memory of 4936	2512	cmd.exe	127
PID 2100 wrote to memory of 1304	2100	cmd.exe	128
PID 2100 wrote to memory of 3424	2100	cmd.exe	129
PID 2100 wrote to memory of 1308	2100	cmd.exe	130
PID 2512 wrote to memory of 2224	2512	cmd.exe	131
PID 2512 wrote to memory of 1332	2512	cmd.exe	132
PID 2512 wrote to memory of 3840	2512	cmd.exe	133
PID 2100 wrote to memory of 5840	2100	cmd.exe	134
PID 2100 wrote to memory of 1500	2100	cmd.exe	135
PID 2100 wrote to memory of 4776	2100	cmd.exe	136
PID 2512 wrote to memory of 1368	2512	cmd.exe	137
PID 2512 wrote to memory of 4356	2512	cmd.exe	138
PID 2512 wrote to memory of 5252	2512	cmd.exe	139
PID 2100 wrote to memory of 4320	2100	cmd.exe	140
PID 2100 wrote to memory of 3304	2100	cmd.exe	141
PID 2100 wrote to memory of 4104	2100	cmd.exe	143
PID 2512 wrote to memory of 3768	2512	cmd.exe	144
PID 2512 wrote to memory of 1408	2512	cmd.exe	145
PID 2512 wrote to memory of 1572	2512	cmd.exe	146
PID 2100 wrote to memory of 2792	2100	cmd.exe	147
PID 2100 wrote to memory of 548	2100	cmd.exe	148
PID 2100 wrote to memory of 5048	2100	cmd.exe	149
PID 2512 wrote to memory of 1228	2512	cmd.exe	150
PID 2512 wrote to memory of 2720	2512	cmd.exe	151
PID 2512 wrote to memory of 3056	2512	cmd.exe	152
PID 2100 wrote to memory of 3664	2100	cmd.exe	153
PID 2100 wrote to memory of 4172	2100	cmd.exe	154
PID 2100 wrote to memory of 2184	2100	cmd.exe	155
PID 2512 wrote to memory of 8	2512	cmd.exe	156
PID 2512 wrote to memory of 1132	2512	cmd.exe	157
PID 2512 wrote to memory of 2392	2512	cmd.exe	158
PID 2100 wrote to memory of 4612	2100	cmd.exe	159
PID 2100 wrote to memory of 5300	2100	cmd.exe	160
PID 2100 wrote to memory of 2692	2100	cmd.exe	161
PID 2512 wrote to memory of 5556	2512	cmd.exe	162
PID 2512 wrote to memory of 4892	2512	cmd.exe	163
PID 2512 wrote to memory of 1032	2512	cmd.exe	164
PID 2100 wrote to memory of 5396	2100	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_aca33936b6e3640351da7b1fd9e4f904_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2412
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4152
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2812
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4668
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1332
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1368
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3768
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1228
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:8
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1132
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4892
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5836
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5384
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4084
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4776
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2716
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2276
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3236
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3732
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2840
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5380
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1888
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3148
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1164
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5184
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2916
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3304
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6136
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1092
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1388

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4652
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1308
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1500
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:548
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5300
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5396
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5724
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4884
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5756
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4684
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5248
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3168
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1308
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6000
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:252
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5804
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2784
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1420
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3972
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4612
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4292
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2580
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3340
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:912
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5144
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2256
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:956
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4512
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4144
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:792
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3108
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5880
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4640
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4932
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yr20fc5e.gya.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yr20fc5e.gya.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.5MB
SHA256 b6c3e90357b4e0da42a1afe9635476210ff40d4142d6b6781b36ee2e8b637432
MD5 f358ac8a6b200ae0d23e49d994d07c8a
SHA1 eea9c87b59aa67db3d5cf9939d29c5ac87ed82f5
SHA512 f7c188b320c34c6be34d5c003c4148e57a059872a7987349f4f0564bf829d88c099aaab713c07f1c7f9de9d538ea1290ee75af7380fb2e20fa8e1d4bb41b773a
SSDEEP 196608:e+hBw+kWByQyVG/uzGNVyAl3K8fCGnbP3JzATC4i:xw+1NSG/lVrl3KExL3JzATzi
TLSH
T1A366016B726901E8E1BFD17C89065907FBB2780543A0A7DF12E046A62F77BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5556-14-0x000001C8BFF10000-0x000001C8BFF32000-memory.dmp

Download

memory/5556-19-0x000001C8C0430000-0x000001C8C044E000-memory.dmp

Download

memory/5556-20-0x000001C8C0450000-0x000001C8C0502000-memory.dmp

Download

memory/5556-23-0x000001C8C0210000-0x000001C8C021A000-memory.dmp

Download