e06716785338ca9599fe2ebac4d0454d18131a628f9cce496663c89b05a50130

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_29e86da1679fcad924dba945df8b7825_icedid_njrat_stealc.exe
Size 3.3MB
Sample260804-js35raztht
SHA256 e06716785338ca9599fe2ebac4d0454d18131a628f9cce496663c89b05a50130
MD5 29e86da1679fcad924dba945df8b7825
SHA1 56b8c85238e98546b333fd83e0d7eab9ce9328bd
SHA512 03a39a04d2e0fb97083ec5c466576fe664412209000f12ea084bd9adddf496e1a454fb32deb21af24c83c12e8ec5fb982f8d399d12775902a4ec836b20a659a1
SSDEEP 49152:i++MB9P91XphIl8pF58HsKkZrXvCHL/Qu2XG8ZoI9Z9rqyI44HppuzGxHHYI:i+hBp75lKkBcgWGoqZ92yVG/uzGND
TLSH
T1BFF5CF2BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1988	powershell.exe
2348	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-08-04_29e86da1679fcad924dba945df8b7825_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
4568	PeerService.exe
3224	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1496	tasklist.exe
4544	tasklist.exe
1380	tasklist.exe
1720	tasklist.exe
644	tasklist.exe
1708	tasklist.exe
2612	tasklist.exe
3936	tasklist.exe
1892	tasklist.exe
1364	tasklist.exe
5052	tasklist.exe
1516	tasklist.exe
748	tasklist.exe
1568	tasklist.exe
1268	tasklist.exe
636	tasklist.exe
4536	tasklist.exe
3860	tasklist.exe
892	tasklist.exe
2196	tasklist.exe
4940	tasklist.exe
5028	tasklist.exe
4596	tasklist.exe
4120	tasklist.exe
1836	tasklist.exe
2940	tasklist.exe
2296	tasklist.exe
3456	tasklist.exe
636	tasklist.exe
1792	tasklist.exe
3580	tasklist.exe
1716	tasklist.exe
3640	tasklist.exe
760	tasklist.exe
3656	tasklist.exe
4280	tasklist.exe
404	tasklist.exe
1700	tasklist.exe
4756	tasklist.exe
1900	tasklist.exe
3968	tasklist.exe
3004	tasklist.exe
2364	tasklist.exe
1716	tasklist.exe
4212	tasklist.exe
932	tasklist.exe
2664	tasklist.exe
3828	tasklist.exe
3088	tasklist.exe
5072	tasklist.exe
1324	tasklist.exe
1236	tasklist.exe
1364	tasklist.exe
564	tasklist.exe
3456	tasklist.exe
1916	tasklist.exe
2936	tasklist.exe
3672	tasklist.exe
4052	tasklist.exe
1864	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1828	cmd.exe
3068	cmd.exe
2864	cmd.exe
4532	cmd.exe
1092	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2132	timeout.exe
2212	timeout.exe
4844	timeout.exe
3792	timeout.exe
1332	timeout.exe
4536	timeout.exe
3244	timeout.exe
864	timeout.exe
4156	timeout.exe
4256	timeout.exe
2532	timeout.exe
5028	timeout.exe
60	timeout.exe
348	timeout.exe
4220	timeout.exe
2536	timeout.exe
3424	timeout.exe
3012	timeout.exe
4400	timeout.exe
4376	timeout.exe
1984	timeout.exe
372	timeout.exe
4800	timeout.exe
3244	timeout.exe
4704	timeout.exe
1052	timeout.exe
724	timeout.exe
1044	timeout.exe
3580	timeout.exe
1504	timeout.exe
2276	timeout.exe
4648	timeout.exe
3444	timeout.exe
4836	timeout.exe
4916	timeout.exe
4948	timeout.exe
3972	timeout.exe
684	timeout.exe
3276	timeout.exe
4172	timeout.exe
460	timeout.exe
5088	timeout.exe
1592	timeout.exe
740	timeout.exe
5052	timeout.exe
2328	timeout.exe
2924	timeout.exe
3132	timeout.exe
4248	timeout.exe
2280	timeout.exe
4464	timeout.exe
4968	timeout.exe
4728	timeout.exe
4440	timeout.exe
1668	timeout.exe
1228	timeout.exe
4748	timeout.exe
3868	timeout.exe
852	timeout.exe
696	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1988	powershell.exe
2348	powershell.exe
1988	powershell.exe
1988	powershell.exe
2348	powershell.exe
2348	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	1268	tasklist.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	636	tasklist.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	748	tasklist.exe
Token: SeDebugPrivilege	3640	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	1708	tasklist.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeDebugPrivilege	3936	tasklist.exe
Token: SeDebugPrivilege	4596	tasklist.exe
Token: SeDebugPrivilege	4120	tasklist.exe
Token: SeDebugPrivilege	3656	tasklist.exe
Token: SeDebugPrivilege	2664	tasklist.exe
Token: SeDebugPrivilege	1892	tasklist.exe
Token: SeDebugPrivilege	3004	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	1836	tasklist.exe
Token: SeDebugPrivilege	636	tasklist.exe
Token: SeDebugPrivilege	404	tasklist.exe
Token: SeDebugPrivilege	1720	tasklist.exe
Token: SeDebugPrivilege	1792	tasklist.exe
Token: SeDebugPrivilege	644	tasklist.exe
Token: SeDebugPrivilege	1364	tasklist.exe
Token: SeDebugPrivilege	4052	tasklist.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeDebugPrivilege	4536	tasklist.exe
Token: SeDebugPrivilege	564	tasklist.exe
Token: SeDebugPrivilege	3580	tasklist.exe
Token: SeDebugPrivilege	5052	tasklist.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeDebugPrivilege	2364	tasklist.exe
Token: SeDebugPrivilege	3860	tasklist.exe
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	932	tasklist.exe
Token: SeDebugPrivilege	1716	tasklist.exe
Token: SeDebugPrivilege	892	tasklist.exe
Token: SeDebugPrivilege	3828	tasklist.exe
Token: SeDebugPrivilege	3088	tasklist.exe
Token: SeDebugPrivilege	5072	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	1324	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	1496	tasklist.exe
Token: SeDebugPrivilege	1516	tasklist.exe
Token: SeDebugPrivilege	1916	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	4940	tasklist.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	1864	tasklist.exe
Token: SeDebugPrivilege	2936	tasklist.exe
Token: SeDebugPrivilege	1716	tasklist.exe
Token: SeDebugPrivilege	3672	tasklist.exe
Token: SeDebugPrivilege	1236	tasklist.exe
Token: SeDebugPrivilege	1364	tasklist.exe
Token: SeDebugPrivilege	3968	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 1828	3576	2026-08-04_29e86da1679fcad924dba945df8b7825_icedid_njrat_stealc.exe	86
PID 1828 wrote to memory of 3924	1828	cmd.exe	88
PID 3576 wrote to memory of 4568	3576	2026-08-04_29e86da1679fcad924dba945df8b7825_icedid_njrat_stealc.exe	90
PID 3224 wrote to memory of 1092	3224	PeerService.exe	93
PID 4568 wrote to memory of 2864	4568	PeerService.exe	95
PID 3224 wrote to memory of 4532	3224	PeerService.exe	94
PID 4568 wrote to memory of 3068	4568	PeerService.exe	96
PID 2864 wrote to memory of 2348	2864	cmd.exe	102
PID 1092 wrote to memory of 1988	1092	cmd.exe	103
PID 3068 wrote to memory of 1268	3068	cmd.exe	104
PID 3068 wrote to memory of 4840	3068	cmd.exe	105
PID 4532 wrote to memory of 636	4532	cmd.exe	107
PID 4532 wrote to memory of 1600	4532	cmd.exe	108
PID 3068 wrote to memory of 2280	3068	cmd.exe	109
PID 4532 wrote to memory of 5028	4532	cmd.exe	110
PID 3068 wrote to memory of 2296	3068	cmd.exe	111
PID 3068 wrote to memory of 2172	3068	cmd.exe	112
PID 3068 wrote to memory of 60	3068	cmd.exe	113
PID 4532 wrote to memory of 748	4532	cmd.exe	114
PID 4532 wrote to memory of 4028	4532	cmd.exe	115
PID 4532 wrote to memory of 2924	4532	cmd.exe	116
PID 3068 wrote to memory of 3640	3068	cmd.exe	117
PID 3068 wrote to memory of 1800	3068	cmd.exe	118
PID 3068 wrote to memory of 2276	3068	cmd.exe	119
PID 4532 wrote to memory of 1900	4532	cmd.exe	120
PID 4532 wrote to memory of 4336	4532	cmd.exe	121
PID 4532 wrote to memory of 2212	4532	cmd.exe	122
PID 3068 wrote to memory of 1708	3068	cmd.exe	123
PID 3068 wrote to memory of 3484	3068	cmd.exe	124
PID 3068 wrote to memory of 4400	3068	cmd.exe	125
PID 4532 wrote to memory of 760	4532	cmd.exe	126
PID 4532 wrote to memory of 980	4532	cmd.exe	127
PID 4532 wrote to memory of 460	4532	cmd.exe	128
PID 3068 wrote to memory of 2612	3068	cmd.exe	129
PID 3068 wrote to memory of 4876	3068	cmd.exe	130
PID 3068 wrote to memory of 4256	3068	cmd.exe	131
PID 4532 wrote to memory of 3456	4532	cmd.exe	132
PID 4532 wrote to memory of 3272	4532	cmd.exe	133
PID 4532 wrote to memory of 4536	4532	cmd.exe	134
PID 3068 wrote to memory of 3936	3068	cmd.exe	135
PID 3068 wrote to memory of 4016	3068	cmd.exe	136
PID 3068 wrote to memory of 1668	3068	cmd.exe	137
PID 4532 wrote to memory of 4596	4532	cmd.exe	138
PID 4532 wrote to memory of 2732	4532	cmd.exe	139
PID 4532 wrote to memory of 3132	4532	cmd.exe	140
PID 3068 wrote to memory of 4120	3068	cmd.exe	142
PID 3068 wrote to memory of 3864	3068	cmd.exe	143
PID 3068 wrote to memory of 1052	3068	cmd.exe	144
PID 4532 wrote to memory of 3656	4532	cmd.exe	145
PID 4532 wrote to memory of 964	4532	cmd.exe	146
PID 4532 wrote to memory of 3972	4532	cmd.exe	147
PID 3068 wrote to memory of 2664	3068	cmd.exe	148
PID 3068 wrote to memory of 4644	3068	cmd.exe	149
PID 3068 wrote to memory of 348	3068	cmd.exe	150
PID 4532 wrote to memory of 1892	4532	cmd.exe	151
PID 4532 wrote to memory of 2536	4532	cmd.exe	152
PID 4532 wrote to memory of 684	4532	cmd.exe	153
PID 3068 wrote to memory of 3004	3068	cmd.exe	154
PID 3068 wrote to memory of 2344	3068	cmd.exe	155
PID 3068 wrote to memory of 4648	3068	cmd.exe	156
PID 4532 wrote to memory of 4280	4532	cmd.exe	157
PID 4532 wrote to memory of 2408	4532	cmd.exe	158
PID 4532 wrote to memory of 4748	4532	cmd.exe	159
PID 3068 wrote to memory of 1836	3068	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-04_29e86da1679fcad924dba945df8b7825_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_29e86da1679fcad924dba945df8b7825_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1268
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4840
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:60
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1800
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3484
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2344
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1836
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4376
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:404
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2188
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1792
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3456
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3272
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:564
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5052
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4648
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1716
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4052
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1324
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2240
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:520
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4156
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1380
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3464
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3344
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3672
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:400
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4928
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4948

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1600
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:460
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2536
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2640
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:840
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4456
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1044
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3868
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:372
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:348
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3424
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4620
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3444
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3388
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:316
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4648
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2204
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4756
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4248
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1404
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4728
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
MD5 b594c0a5591fab95a43185dd9944a231
SHA1 3d725e779790f3525ba12b0666f0a3a235644fed
SHA512 452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73
TLSH
T1C7112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r1nygmgv.qls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r1nygmgv.qls.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.6MB
SHA256 84b618f3d60aa1fab78c13e2a5486c3c4b1d1b5270265b56411ad0eb3c5439ad
MD5 778d1a1639bcf4e354bdc39656bf7dd0
SHA1 fff72fad221806d40fa9ab52cca2e5a4f882f55e
SHA512 b9b25ef1a525c7cf48d6c7e06643fb5574ce0c8baa7233bbb9b7b792e14a16114bd9bf93d57afa158ab50208c6630e4396a798eeb6c3eb9290dcb668712df406
SSDEEP 196608:i+hBtOkSXByQyVG/uzGNTByQyVG/uzGNVyAl3K8fCGnbP3JzAT6:ltOlNSG/lVNSG/lVrl3KExL3JzAT6
TLSH
T10C86022BB26901E8D1BFD17CC9165907EBB2780543A0A7DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1988-28-0x00000292DA1F0000-0x00000292DA212000-memory.dmp

Download