1b878ee7cb07b2687c3963adf69139227d014159c0998f05e3ae294c3cd2a31e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_3245e80c2b472dbcbe16c3691b92293f_icedid_njrat_stealc.exe
Size 5.0MB
Sample260810-syj4hasbmg
SHA256 1b878ee7cb07b2687c3963adf69139227d014159c0998f05e3ae294c3cd2a31e
MD5 3245e80c2b472dbcbe16c3691b92293f
SHA1 02b1fd98343f1c03dd497688f285c9bb11e61305
SHA512 fe7bf9d0b7dbc22e957892e7e7c50a3d47300dad660430c184e674e7d50dbb0b4903f14a00d99d14f29eb5eb29ba5baa01b67ccb57b1ef20e4714131870f298d
SSDEEP 98304:s+hBp751KkxckWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVZ:s+hBt+kCDByQyVG/uzGNVyAl3K8fCr
TLSH
T1C636F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3932	powershell.exe
5676	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2932	PeerService.exe
5504	PeerService.exe

Discovers running processes 1 TTPs 58 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5580	tasklist.exe
3368	tasklist.exe
4424	tasklist.exe
2888	tasklist.exe
4244	tasklist.exe
972	tasklist.exe
5132	tasklist.exe
5104	tasklist.exe
2564	tasklist.exe
2536	tasklist.exe
2288	tasklist.exe
3532	tasklist.exe
5424	tasklist.exe
1248	tasklist.exe
4224	tasklist.exe
5864	tasklist.exe
4720	tasklist.exe
4144	tasklist.exe
2272	tasklist.exe
4384	tasklist.exe
4576	tasklist.exe
5872	tasklist.exe
4256	tasklist.exe
2944	tasklist.exe
2672	tasklist.exe
4132	tasklist.exe
3808	tasklist.exe
1672	tasklist.exe
2760	tasklist.exe
2804	tasklist.exe
2616	tasklist.exe
3420	tasklist.exe
1680	tasklist.exe
3472	tasklist.exe
3336	tasklist.exe
920	tasklist.exe
2544	tasklist.exe
4328	tasklist.exe
2844	tasklist.exe
3496	tasklist.exe
6080	tasklist.exe
2312	tasklist.exe
3216	tasklist.exe
5084	tasklist.exe
1920	tasklist.exe
1988	tasklist.exe
4492	tasklist.exe
4604	tasklist.exe
2196	tasklist.exe
5848	tasklist.exe
4844	tasklist.exe
4960	tasklist.exe
4216	tasklist.exe
2196	tasklist.exe
4580	tasklist.exe
2276	tasklist.exe
4312	tasklist.exe
1544	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe
572	cmd.exe
5224	cmd.exe
5260	cmd.exe
1716	cmd.exe

Delays execution with timeout.exe 58 IoCs

defense_evasion

pid	Process
4304	timeout.exe
3048	timeout.exe
5188	timeout.exe
5512	timeout.exe
2720	timeout.exe
1008	timeout.exe
4812	timeout.exe
1548	timeout.exe
2000	timeout.exe
4320	timeout.exe
6140	timeout.exe
2196	timeout.exe
1784	timeout.exe
4124	timeout.exe
1052	timeout.exe
2420	timeout.exe
4520	timeout.exe
1668	timeout.exe
2396	timeout.exe
5720	timeout.exe
4444	timeout.exe
3116	timeout.exe
1812	timeout.exe
3196	timeout.exe
5264	timeout.exe
5656	timeout.exe
4704	timeout.exe
5212	timeout.exe
5508	timeout.exe
6104	timeout.exe
4180	timeout.exe
1120	timeout.exe
1072	timeout.exe
5884	timeout.exe
1720	timeout.exe
2820	timeout.exe
3128	timeout.exe
5360	timeout.exe
2820	timeout.exe
1548	timeout.exe
2516	timeout.exe
1012	timeout.exe
5980	timeout.exe
1644	timeout.exe
4492	timeout.exe
4896	timeout.exe
1404	timeout.exe
1840	timeout.exe
920	timeout.exe
2520	timeout.exe
1180	timeout.exe
2264	timeout.exe
3712	timeout.exe
5996	timeout.exe
2272	timeout.exe
2200	timeout.exe
5976	timeout.exe
5852	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5676	powershell.exe
5676	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
5676	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	4576	tasklist.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe
Token: SeIncreaseQuotaPrivilege	5676	powershell.exe
Token: SeSecurityPrivilege	5676	powershell.exe
Token: SeTakeOwnershipPrivilege	5676	powershell.exe
Token: SeLoadDriverPrivilege	5676	powershell.exe
Token: SeSystemProfilePrivilege	5676	powershell.exe
Token: SeSystemtimePrivilege	5676	powershell.exe
Token: SeProfSingleProcessPrivilege	5676	powershell.exe
Token: SeIncBasePriorityPrivilege	5676	powershell.exe
Token: SeCreatePagefilePrivilege	5676	powershell.exe
Token: SeBackupPrivilege	5676	powershell.exe
Token: SeRestorePrivilege	5676	powershell.exe
Token: SeShutdownPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeSystemEnvironmentPrivilege	5676	powershell.exe
Token: SeRemoteShutdownPrivilege	5676	powershell.exe
Token: SeUndockPrivilege	5676	powershell.exe
Token: SeManageVolumePrivilege	5676	powershell.exe
Token: 33	5676	powershell.exe
Token: 34	5676	powershell.exe
Token: 35	5676	powershell.exe
Token: 36	5676	powershell.exe
Token: SeDebugPrivilege	5580	tasklist.exe
Token: SeDebugPrivilege	5104	tasklist.exe
Token: SeDebugPrivilege	2544	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	4492	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	2564	tasklist.exe
Token: SeDebugPrivilege	5872	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	4224	tasklist.exe
Token: SeDebugPrivilege	2804	tasklist.exe
Token: SeDebugPrivilege	1680	tasklist.exe
Token: SeDebugPrivilege	2536	tasklist.exe
Token: SeDebugPrivilege	3368	tasklist.exe
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	4256	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1716	616	2026-08-10_3245e80c2b472dbcbe16c3691b92293f_icedid_njrat_stealc.exe	90
PID 1716 wrote to memory of 1820	1716	cmd.exe	92
PID 616 wrote to memory of 2932	616	2026-08-10_3245e80c2b472dbcbe16c3691b92293f_icedid_njrat_stealc.exe	93
PID 2932 wrote to memory of 4512	2932	PeerService.exe	96
PID 2932 wrote to memory of 572	2932	PeerService.exe	97
PID 5504 wrote to memory of 5224	5504	PeerService.exe	101
PID 5504 wrote to memory of 5260	5504	PeerService.exe	103
PID 5224 wrote to memory of 5676	5224	cmd.exe	106
PID 4512 wrote to memory of 3932	4512	cmd.exe	107
PID 5260 wrote to memory of 4720	5260	cmd.exe	108
PID 5260 wrote to memory of 5900	5260	cmd.exe	109
PID 572 wrote to memory of 4576	572	cmd.exe	110
PID 572 wrote to memory of 1936	572	cmd.exe	111
PID 572 wrote to memory of 2516	572	cmd.exe	114
PID 5260 wrote to memory of 2396	5260	cmd.exe	115
PID 5260 wrote to memory of 5580	5260	cmd.exe	116
PID 5260 wrote to memory of 3472	5260	cmd.exe	117
PID 572 wrote to memory of 5104	572	cmd.exe	118
PID 572 wrote to memory of 6100	572	cmd.exe	119
PID 5260 wrote to memory of 1812	5260	cmd.exe	120
PID 572 wrote to memory of 4180	572	cmd.exe	121
PID 572 wrote to memory of 2544	572	cmd.exe	122
PID 572 wrote to memory of 1920	572	cmd.exe	123
PID 5260 wrote to memory of 2196	5260	cmd.exe	124
PID 5260 wrote to memory of 5616	5260	cmd.exe	125
PID 572 wrote to memory of 4320	572	cmd.exe	126
PID 5260 wrote to memory of 4124	5260	cmd.exe	127
PID 572 wrote to memory of 4492	572	cmd.exe	128
PID 572 wrote to memory of 2016	572	cmd.exe	129
PID 5260 wrote to memory of 4384	5260	cmd.exe	130
PID 5260 wrote to memory of 2028	5260	cmd.exe	131
PID 572 wrote to memory of 1548	572	cmd.exe	132
PID 5260 wrote to memory of 2272	5260	cmd.exe	133
PID 572 wrote to memory of 1672	572	cmd.exe	135
PID 5260 wrote to memory of 4216	5260	cmd.exe	134
PID 5260 wrote to memory of 3868	5260	cmd.exe	136
PID 572 wrote to memory of 5600	572	cmd.exe	137
PID 5260 wrote to memory of 5512	5260	cmd.exe	138
PID 572 wrote to memory of 3196	572	cmd.exe	139
PID 5260 wrote to memory of 2564	5260	cmd.exe	141
PID 5260 wrote to memory of 1564	5260	cmd.exe	142
PID 572 wrote to memory of 5872	572	cmd.exe	143
PID 572 wrote to memory of 5776	572	cmd.exe	144
PID 5260 wrote to memory of 5264	5260	cmd.exe	145
PID 572 wrote to memory of 2200	572	cmd.exe	146
PID 5260 wrote to memory of 2760	5260	cmd.exe	147
PID 5260 wrote to memory of 1280	5260	cmd.exe	148
PID 572 wrote to memory of 4224	572	cmd.exe	149
PID 572 wrote to memory of 2716	572	cmd.exe	150
PID 5260 wrote to memory of 2820	5260	cmd.exe	151
PID 572 wrote to memory of 1012	572	cmd.exe	152
PID 572 wrote to memory of 2804	572	cmd.exe	154
PID 5260 wrote to memory of 1680	5260	cmd.exe	153
PID 572 wrote to memory of 6012	572	cmd.exe	155
PID 5260 wrote to memory of 4600	5260	cmd.exe	156
PID 5260 wrote to memory of 1052	5260	cmd.exe	157
PID 572 wrote to memory of 5720	572	cmd.exe	158
PID 5260 wrote to memory of 2536	5260	cmd.exe	159
PID 5260 wrote to memory of 6040	5260	cmd.exe	160
PID 572 wrote to memory of 3368	572	cmd.exe	161
PID 572 wrote to memory of 2732	572	cmd.exe	162
PID 572 wrote to memory of 2420	572	cmd.exe	163
PID 5260 wrote to memory of 1404	5260	cmd.exe	164
PID 5260 wrote to memory of 4604	5260	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_3245e80c2b472dbcbe16c3691b92293f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3245e80c2b472dbcbe16c3691b92293f_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2544
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4492
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1672
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2200
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2716
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6012
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3368
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2732
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5924
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6120
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5616
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3420
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:248
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2944
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:620
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3336
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:568
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1748
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2276
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4312
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5084
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2008
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6084
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2616
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5652
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5864
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:248
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6080
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1180

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3472
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5616
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4124
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5512
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4600
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1052
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1404
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5656
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3472
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4944
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4244
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5876
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4168
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2844
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3216
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5720
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3484
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2512
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4288
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1248
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5160
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2196
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4580
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2000
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5956
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4960
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4896
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2888
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3dzya12t.fyi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3dzya12t.fyi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 5.9MB
SHA256 c6dc179aca352b8cd095062987921cbe5e7525158ca67c13b28750bfbe079506
MD5 cb52457a4009af88718d9e17e63240da
SHA1 7e119e40f5534046fef9197741f3ab68507de7e8
SHA512 bf7d241705e39c9c3e738337f1e5bd4e06f38800cc031afd2019896af2154fb3c90e605ac9e7318da1b5459f856eac5c603f4f18df013e90ad4de0525a1a142b
SSDEEP 98304:M+hBp751KkxcWWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWNxN:M+hBt+kCxByQyVG/uzGNVyAl3K8fCGnB
TLSH
T12E56F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3932-14-0x000002271B010000-0x000002271B032000-memory.dmp

Download

memory/5676-19-0x000001D8A6EA0000-0x000001D8A6EBE000-memory.dmp

Download

memory/5676-20-0x000001D8A6EC0000-0x000001D8A6F72000-memory.dmp

Download

memory/5676-23-0x000001D8A6F80000-0x000001D8A6F8A000-memory.dmp

Download