9c69e102b0be6fddbc9755c16f2eee7dd53102ad47d4e441eecd599c0fe7032e

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_81a6d55488970d16c957f209fb99c908_icedid_njrat_stealc.exe
Size 5.1MB
Sample260826-x7cs1avepg
SHA256 9c69e102b0be6fddbc9755c16f2eee7dd53102ad47d4e441eecd599c0fe7032e
MD5 81a6d55488970d16c957f209fb99c908
SHA1 3161792e0a13e79dbe3a6fa89e76c90aa537a8dc
SHA512 3af2fbe8037f27295430e220923e50880ee2b92c988e32ac3521f44e4765a671c3ccbe17bfb00adf126fee925ce36a58cba782b026e2ebc3fca65e2ec833eadd
SSDEEP 98304:u+hBp75lKkBcpWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQX:u+hBtOkS0ByQyVG/uzGNVyAl3K8fCGX
TLSH
T15746F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe
4328	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2560	PeerService.exe
4156	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3216	tasklist.exe
2400	tasklist.exe
5296	tasklist.exe
2464	tasklist.exe
4532	tasklist.exe
948	tasklist.exe
2664	tasklist.exe
2416	tasklist.exe
992	tasklist.exe
5136	tasklist.exe
5056	tasklist.exe
3484	tasklist.exe
688	tasklist.exe
1380	tasklist.exe
3288	tasklist.exe
5100	tasklist.exe
596	tasklist.exe
3372	tasklist.exe
4284	tasklist.exe
5432	tasklist.exe
3956	tasklist.exe
2516	tasklist.exe
248	tasklist.exe
6008	tasklist.exe
3124	tasklist.exe
688	tasklist.exe
1360	tasklist.exe
5744	tasklist.exe
1640	tasklist.exe
2824	tasklist.exe
5440	tasklist.exe
3032	tasklist.exe
860	tasklist.exe
3776	tasklist.exe
1592	tasklist.exe
4780	tasklist.exe
1764	tasklist.exe
5596	tasklist.exe
4476	tasklist.exe
4172	tasklist.exe
1164	tasklist.exe
3700	tasklist.exe
5908	tasklist.exe
5844	tasklist.exe
708	tasklist.exe
3776	tasklist.exe
1028	tasklist.exe
992	tasklist.exe
5264	tasklist.exe
1160	tasklist.exe
5684	tasklist.exe
3416	tasklist.exe
5284	tasklist.exe
3560	tasklist.exe
5772	tasklist.exe
5364	tasklist.exe
3520	tasklist.exe
612	tasklist.exe
4280	tasklist.exe
5704	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1628	cmd.exe
6048	cmd.exe
5960	cmd.exe
5680	cmd.exe
1796	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
4900	timeout.exe
3048	timeout.exe
5996	timeout.exe
3372	timeout.exe
6120	timeout.exe
5692	timeout.exe
5144	timeout.exe
3368	timeout.exe
5692	timeout.exe
2144	timeout.exe
2140	timeout.exe
3504	timeout.exe
2828	timeout.exe
3264	timeout.exe
5712	timeout.exe
2528	timeout.exe
1700	timeout.exe
3040	timeout.exe
2444	timeout.exe
4716	timeout.exe
2624	timeout.exe
4416	timeout.exe
5436	timeout.exe
4548	timeout.exe
704	timeout.exe
4712	timeout.exe
4484	timeout.exe
5656	timeout.exe
4392	timeout.exe
1920	timeout.exe
4888	timeout.exe
4172	timeout.exe
4132	timeout.exe
2912	timeout.exe
3860	timeout.exe
3564	timeout.exe
2136	timeout.exe
4072	timeout.exe
2980	timeout.exe
4716	timeout.exe
6136	timeout.exe
2672	timeout.exe
4232	timeout.exe
5012	timeout.exe
5248	timeout.exe
4900	timeout.exe
4392	timeout.exe
5668	timeout.exe
2884	timeout.exe
5896	timeout.exe
4904	timeout.exe
5152	timeout.exe
2972	timeout.exe
824	timeout.exe
3120	timeout.exe
4888	timeout.exe
3544	timeout.exe
5908	timeout.exe
4092	timeout.exe
5524	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5772	tasklist.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe
Token: SeUndockPrivilege	2104	powershell.exe
Token: SeManageVolumePrivilege	2104	powershell.exe
Token: 33	2104	powershell.exe
Token: 34	2104	powershell.exe
Token: 35	2104	powershell.exe
Token: 36	2104	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	992	tasklist.exe
Token: SeDebugPrivilege	5284	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	688	tasklist.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeDebugPrivilege	3560	tasklist.exe
Token: SeDebugPrivilege	3776	tasklist.exe
Token: SeDebugPrivilege	5136	tasklist.exe
Token: SeDebugPrivilege	1164	tasklist.exe
Token: SeDebugPrivilege	3416	tasklist.exe
Token: SeDebugPrivilege	3520	tasklist.exe
Token: SeDebugPrivilege	5364	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	5844	tasklist.exe
Token: SeDebugPrivilege	708	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1628	3452	2026-08-25_81a6d55488970d16c957f209fb99c908_icedid_njrat_stealc.exe	90
PID 1628 wrote to memory of 4296	1628	cmd.exe	92
PID 3452 wrote to memory of 4156	3452	2026-08-25_81a6d55488970d16c957f209fb99c908_icedid_njrat_stealc.exe	95
PID 2560 wrote to memory of 5960	2560	PeerService.exe	97
PID 2560 wrote to memory of 6048	2560	PeerService.exe	98
PID 4156 wrote to memory of 1796	4156	PeerService.exe	101
PID 4156 wrote to memory of 5680	4156	PeerService.exe	102
PID 5960 wrote to memory of 2104	5960	cmd.exe	106
PID 6048 wrote to memory of 5772	6048	cmd.exe	107
PID 6048 wrote to memory of 4120	6048	cmd.exe	108
PID 5680 wrote to memory of 3032	5680	cmd.exe	109
PID 5680 wrote to memory of 696	5680	cmd.exe	110
PID 1796 wrote to memory of 4328	1796	cmd.exe	111
PID 6048 wrote to memory of 2884	6048	cmd.exe	114
PID 5680 wrote to memory of 4904	5680	cmd.exe	115
PID 5680 wrote to memory of 860	5680	cmd.exe	116
PID 5680 wrote to memory of 944	5680	cmd.exe	117
PID 6048 wrote to memory of 992	6048	cmd.exe	118
PID 6048 wrote to memory of 4868	6048	cmd.exe	119
PID 5680 wrote to memory of 4416	5680	cmd.exe	120
PID 6048 wrote to memory of 4392	6048	cmd.exe	121
PID 6048 wrote to memory of 5284	6048	cmd.exe	122
PID 6048 wrote to memory of 1488	6048	cmd.exe	123
PID 5680 wrote to memory of 4172	5680	cmd.exe	124
PID 5680 wrote to memory of 3700	5680	cmd.exe	125
PID 5680 wrote to memory of 3564	5680	cmd.exe	126
PID 6048 wrote to memory of 5152	6048	cmd.exe	127
PID 6048 wrote to memory of 1380	6048	cmd.exe	128
PID 6048 wrote to memory of 3744	6048	cmd.exe	129
PID 5680 wrote to memory of 688	5680	cmd.exe	130
PID 5680 wrote to memory of 1144	5680	cmd.exe	131
PID 6048 wrote to memory of 2528	6048	cmd.exe	132
PID 5680 wrote to memory of 5436	5680	cmd.exe	133
PID 5680 wrote to memory of 5596	5680	cmd.exe	134
PID 5680 wrote to memory of 596	5680	cmd.exe	135
PID 6048 wrote to memory of 3560	6048	cmd.exe	136
PID 6048 wrote to memory of 5428	6048	cmd.exe	137
PID 5680 wrote to memory of 3372	5680	cmd.exe	138
PID 6048 wrote to memory of 5248	6048	cmd.exe	139
PID 5680 wrote to memory of 3776	5680	cmd.exe	140
PID 5680 wrote to memory of 3704	5680	cmd.exe	141
PID 6048 wrote to memory of 5136	6048	cmd.exe	142
PID 6048 wrote to memory of 1112	6048	cmd.exe	143
PID 5680 wrote to memory of 4888	5680	cmd.exe	144
PID 6048 wrote to memory of 5692	6048	cmd.exe	145
PID 6048 wrote to memory of 1164	6048	cmd.exe	147
PID 6048 wrote to memory of 2212	6048	cmd.exe	148
PID 5680 wrote to memory of 3416	5680	cmd.exe	149
PID 5680 wrote to memory of 4988	5680	cmd.exe	150
PID 6048 wrote to memory of 4900	6048	cmd.exe	151
PID 5680 wrote to memory of 3544	5680	cmd.exe	152
PID 5680 wrote to memory of 3520	5680	cmd.exe	153
PID 5680 wrote to memory of 4164	5680	cmd.exe	154
PID 6048 wrote to memory of 5364	6048	cmd.exe	155
PID 6048 wrote to memory of 5388	6048	cmd.exe	156
PID 6048 wrote to memory of 1920	6048	cmd.exe	157
PID 5680 wrote to memory of 3048	5680	cmd.exe	158
PID 6048 wrote to memory of 4280	6048	cmd.exe	159
PID 6048 wrote to memory of 5056	6048	cmd.exe	160
PID 5680 wrote to memory of 5844	5680	cmd.exe	161
PID 5680 wrote to memory of 2052	5680	cmd.exe	162
PID 6048 wrote to memory of 5908	6048	cmd.exe	163
PID 5680 wrote to memory of 2140	5680	cmd.exe	164
PID 5680 wrote to memory of 708	5680	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-25_81a6d55488970d16c957f209fb99c908_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_81a6d55488970d16c957f209fb99c908_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4296
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:944
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3700
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1144
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5596
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:596
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3776
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2052
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:708
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3216
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1160
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5684
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5580
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4476
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2400
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4212
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5736
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5908
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3124
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3700
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1428
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5440
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3776
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2664
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4284
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2624

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4120
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2884
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1488
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5152
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2528
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5248
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5364
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5388
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5908
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5896
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:248
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3700
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5296
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5996
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2464
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5192
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3288
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5484
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6136
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2628
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5056
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4712
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5288
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6008
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4780
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1576
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3956
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2612
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2516
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:688
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:596
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2932
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5668
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:948
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2456
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2912
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5704
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0k4cmaes.4ox.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0k4cmaes.4ox.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.4MB
SHA256 081bfaf5f33a52460f6faf75e653be727d913cd36cb5bf70c4abd378a84899e4
MD5 f2cdd57fcbc4df34a87167ff8e0df4d3
SHA1 a915f830490b6e822a2404aa2ccda89ada4ee294
SHA512 d69400fef98caf188b7b67265273823040c0264606c1c36539456e5148ed52a8bdfaf84ff20ebb4f170ee48cf48d2aec30d393dbef62427a0776fe50adf5e137
SSDEEP 98304:u+hBp75lKkBc9WGoqZ92yVG/uzGNV9HkAVHL/D/:u+hBtOkSwByQyVG/uzGNVyAl3/
TLSH
T11426E06BB26901E8D1BFD17CC9165907EBB2780543A0A7CF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-13-0x0000026F8A620000-0x0000026F8A642000-memory.dmp

Download

memory/2104-18-0x0000026FA27F0000-0x0000026FA280E000-memory.dmp

Download

memory/2104-19-0x0000026FA2AB0000-0x0000026FA2B62000-memory.dmp

Download

memory/2104-20-0x0000026F8A690000-0x0000026F8A69A000-memory.dmp

Download