f6c96fb7083185fd059cfdd5d17ff18fd5a4b41ac484643c80e5b4f5e7c5715a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe
Size 6.5MB
Sample260827-r4tpfsam71
SHA256 f6c96fb7083185fd059cfdd5d17ff18fd5a4b41ac484643c80e5b4f5e7c5715a
MD5 76a4108a11fb56eee831966e3db7df2a
SHA1 51d4d8c2bc000b41f1fb6cce0f4eef86a49d6d95
SHA512 8de6a3c4ed7cd4742aa8a861e1ba9513b9089e6a99ab4f497af34b0043ecc390aafbb458e808de35daa0e03758514a0c674996c1511024767e334df0c6e1995b
SSDEEP 196608:s+hBtOkStByQyVG/uzGNVyAl3K8fCGnbP3JzATC47:7tO/NSG/lVrl3KExL3JzATz7
TLSH
T1C966012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2212	powershell.exe
224	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1004	PeerService.exe
1796	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
460	tasklist.exe
4528	tasklist.exe
3244	tasklist.exe
3324	tasklist.exe
3124	tasklist.exe
1052	tasklist.exe
4244	tasklist.exe
228	tasklist.exe
4232	tasklist.exe
3568	tasklist.exe
1852	tasklist.exe
2152	tasklist.exe
1636	tasklist.exe
3232	tasklist.exe
4680	tasklist.exe
2340	tasklist.exe
740	tasklist.exe
1644	tasklist.exe
4408	tasklist.exe
4620	tasklist.exe
4900	tasklist.exe
3016	tasklist.exe
4112	tasklist.exe
2608	tasklist.exe
1920	tasklist.exe
1272	tasklist.exe
696	tasklist.exe
1056	tasklist.exe
1528	tasklist.exe
1752	tasklist.exe
468	tasklist.exe
4832	tasklist.exe
2008	tasklist.exe
4152	tasklist.exe
1972	tasklist.exe
5076	tasklist.exe
2024	tasklist.exe
2744	tasklist.exe
452	tasklist.exe
5080	tasklist.exe
4572	tasklist.exe
3032	tasklist.exe
3320	tasklist.exe
4576	tasklist.exe
4188	tasklist.exe
4176	tasklist.exe
3064	tasklist.exe
1240	tasklist.exe
2148	tasklist.exe
1232	tasklist.exe
4176	tasklist.exe
1760	tasklist.exe
3632	tasklist.exe
3712	tasklist.exe
4908	tasklist.exe
312	tasklist.exe
632	tasklist.exe
1400	tasklist.exe
4652	tasklist.exe
468	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2664	cmd.exe
1832	cmd.exe
3656	cmd.exe
5072	cmd.exe
4948	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3324	timeout.exe
4652	timeout.exe
4440	timeout.exe
1728	timeout.exe
2744	timeout.exe
1012	timeout.exe
3384	timeout.exe
4828	timeout.exe
1012	timeout.exe
3740	timeout.exe
3304	timeout.exe
2164	timeout.exe
4704	timeout.exe
3648	timeout.exe
2412	timeout.exe
4508	timeout.exe
2608	timeout.exe
456	timeout.exe
4396	timeout.exe
4048	timeout.exe
3916	timeout.exe
4392	timeout.exe
4240	timeout.exe
612	timeout.exe
4112	timeout.exe
1800	timeout.exe
3784	timeout.exe
1492	timeout.exe
3784	timeout.exe
2536	timeout.exe
1364	timeout.exe
752	timeout.exe
3632	timeout.exe
1288	timeout.exe
936	timeout.exe
1304	timeout.exe
1276	timeout.exe
3816	timeout.exe
4392	timeout.exe
5040	timeout.exe
1652	timeout.exe
380	timeout.exe
1380	timeout.exe
2096	timeout.exe
3316	timeout.exe
4908	timeout.exe
4788	timeout.exe
3768	timeout.exe
4984	timeout.exe
4532	timeout.exe
2096	timeout.exe
4832	timeout.exe
4680	timeout.exe
2632	timeout.exe
2200	timeout.exe
3316	timeout.exe
1036	timeout.exe
4144	timeout.exe
1852	timeout.exe
4452	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2212	powershell.exe
2212	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	tasklist.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1400	tasklist.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeDebugPrivilege	1272	tasklist.exe
Token: SeDebugPrivilege	4152	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	452	tasklist.exe
Token: SeDebugPrivilege	696	tasklist.exe
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeDebugPrivilege	4112	tasklist.exe
Token: SeDebugPrivilege	460	tasklist.exe
Token: SeDebugPrivilege	1752	tasklist.exe
Token: SeDebugPrivilege	3124	tasklist.exe
Token: SeDebugPrivilege	5076	tasklist.exe
Token: SeDebugPrivilege	468	tasklist.exe
Token: SeDebugPrivilege	1240	tasklist.exe
Token: SeDebugPrivilege	4528	tasklist.exe
Token: SeDebugPrivilege	1644	tasklist.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	3324	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	5080	tasklist.exe
Token: SeDebugPrivilege	4680	tasklist.exe
Token: SeDebugPrivilege	1232	tasklist.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	1760	tasklist.exe
Token: SeDebugPrivilege	1052	tasklist.exe
Token: SeDebugPrivilege	4244	tasklist.exe
Token: SeDebugPrivilege	3568	tasklist.exe
Token: SeDebugPrivilege	2340	tasklist.exe
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	3712	tasklist.exe
Token: SeDebugPrivilege	4408	tasklist.exe
Token: SeDebugPrivilege	228	tasklist.exe
Token: SeDebugPrivilege	1920	tasklist.exe
Token: SeDebugPrivilege	4908	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	2024	tasklist.exe
Token: SeDebugPrivilege	2152	tasklist.exe
Token: SeDebugPrivilege	740	tasklist.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	4900	tasklist.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	312	tasklist.exe
Token: SeDebugPrivilege	2148	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe
Token: SeDebugPrivilege	4232	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	468	tasklist.exe
Token: SeDebugPrivilege	3232	tasklist.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	3016	tasklist.exe
Token: SeDebugPrivilege	632	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2664	1292	2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe	86
PID 2664 wrote to memory of 1452	2664	cmd.exe	88
PID 1292 wrote to memory of 1004	1292	2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe	89
PID 1004 wrote to memory of 3656	1004	PeerService.exe	92
PID 1004 wrote to memory of 1832	1004	PeerService.exe	93
PID 3656 wrote to memory of 2212	3656	cmd.exe	96
PID 1832 wrote to memory of 4576	1832	cmd.exe	99
PID 1796 wrote to memory of 4948	1796	PeerService.exe	100
PID 1796 wrote to memory of 5072	1796	PeerService.exe	101
PID 1832 wrote to memory of 1988	1832	cmd.exe	104
PID 4948 wrote to memory of 224	4948	cmd.exe	105
PID 5072 wrote to memory of 1400	5072	cmd.exe	106
PID 5072 wrote to memory of 3784	5072	cmd.exe	107
PID 1832 wrote to memory of 936	1832	cmd.exe	109
PID 5072 wrote to memory of 1012	5072	cmd.exe	110
PID 1832 wrote to memory of 4188	1832	cmd.exe	115
PID 1832 wrote to memory of 4528	1832	cmd.exe	116
PID 5072 wrote to memory of 1272	5072	cmd.exe	117
PID 5072 wrote to memory of 5032	5072	cmd.exe	118
PID 1832 wrote to memory of 4984	1832	cmd.exe	119
PID 5072 wrote to memory of 1036	5072	cmd.exe	120
PID 5072 wrote to memory of 4152	5072	cmd.exe	123
PID 5072 wrote to memory of 2964	5072	cmd.exe	124
PID 1832 wrote to memory of 3064	1832	cmd.exe	125
PID 1832 wrote to memory of 4252	1832	cmd.exe	126
PID 5072 wrote to memory of 456	5072	cmd.exe	127
PID 1832 wrote to memory of 4144	1832	cmd.exe	128
PID 1832 wrote to memory of 452	1832	cmd.exe	134
PID 1832 wrote to memory of 1776	1832	cmd.exe	135
PID 5072 wrote to memory of 696	5072	cmd.exe	136
PID 5072 wrote to memory of 684	5072	cmd.exe	137
PID 1832 wrote to memory of 2536	1832	cmd.exe	138
PID 5072 wrote to memory of 4396	5072	cmd.exe	139
PID 1832 wrote to memory of 1972	1832	cmd.exe	143
PID 5072 wrote to memory of 4112	5072	cmd.exe	144
PID 1832 wrote to memory of 4556	1832	cmd.exe	145
PID 5072 wrote to memory of 592	5072	cmd.exe	146
PID 5072 wrote to memory of 3384	5072	cmd.exe	147
PID 1832 wrote to memory of 3304	1832	cmd.exe	148
PID 1832 wrote to memory of 460	1832	cmd.exe	154
PID 5072 wrote to memory of 1752	5072	cmd.exe	153
PID 1832 wrote to memory of 4780	1832	cmd.exe	155
PID 5072 wrote to memory of 452	5072	cmd.exe	156
PID 5072 wrote to memory of 612	5072	cmd.exe	157
PID 1832 wrote to memory of 4828	1832	cmd.exe	158
PID 5072 wrote to memory of 3124	5072	cmd.exe	161
PID 5072 wrote to memory of 4672	5072	cmd.exe	162
PID 1832 wrote to memory of 5076	1832	cmd.exe	163
PID 1832 wrote to memory of 5096	1832	cmd.exe	164
PID 5072 wrote to memory of 4048	5072	cmd.exe	166
PID 1832 wrote to memory of 4112	1832	cmd.exe	167
PID 5072 wrote to memory of 468	5072	cmd.exe	168
PID 5072 wrote to memory of 380	5072	cmd.exe	169
PID 1832 wrote to memory of 1240	1832	cmd.exe	170
PID 1832 wrote to memory of 3216	1832	cmd.exe	171
PID 5072 wrote to memory of 1012	5072	cmd.exe	172
PID 1832 wrote to memory of 2096	1832	cmd.exe	173
PID 1832 wrote to memory of 4528	1832	cmd.exe	174
PID 1832 wrote to memory of 4384	1832	cmd.exe	175
PID 5072 wrote to memory of 1644	5072	cmd.exe	176
PID 5072 wrote to memory of 4176	5072	cmd.exe	177
PID 1832 wrote to memory of 1364	1832	cmd.exe	178
PID 5072 wrote to memory of 4508	5072	cmd.exe	179
PID 1832 wrote to memory of 3244	1832	cmd.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1452
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4188
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3576
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1232
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2808
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2608
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4620
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4908
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1728
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3568
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4532
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:312
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2200
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1852
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1972
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2728
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3156
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1288
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3320
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4232
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3624
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3232
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:212
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3016
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3768

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5032
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:696
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:684
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:592
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3384
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:612
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2632
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2020
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2096
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3784
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3124
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:760
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4400
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3648
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2060
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2744
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2288
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2412
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4828
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2144
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1728
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4768
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a3a88d14e521190bbc743ba40314890ec7647691a9e8f86ba29523260e87509b
MD5 c3693dbc26f74af177118d25f590835a
SHA1 561f98fb33fcf91e3f9a7054aee157007c584b1d
SHA512 7edff9ad027d86e89837b2b8dcbd06840b5e514aef6b9d82013bb9f7063677a39ea952d13cb15f7893ec2bb3d050c0acdffe4c75f2851582a3e4341ad73533e6
TLSH
T13A218627B3DC8A21CC86163A109D9C10767683C7809ECF9F6BC4D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vz3bkbm2.qzz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vz3bkbm2.qzz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 10.3MB
SHA256 96e3fa3f19d63e365a4d9db0abbac10e118c7de2ccdaf67f3cbe160fe9b8227e
MD5 0c100c3527a3fc0eeaa3f3153a73ab3e
SHA1 087cbb4f62ea1800113ed3304405664dc3c6b648
SHA512 b43258b32ba281e2ab750d768870c57811e3439a71e217c11b1fbbcbe8ef623ae4adba45e80eece810909c8c1fca17a28a9ee3fef18aad7b3fb4dbe458bfedcf
SSDEEP 196608:s+hBtOkStByQyVG/uzGNVyAl3K8fCGnbP3JzATC4LByQyVG/uzGNVyAl3K8fCGnD:7tO/NSG/lVrl3KExL3JzATzdNSG/lVrL
TLSH
T136B6126BB26901E8E1BFD17CC9065907FBB2780543A096DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-44-0x00000289BA3B0000-0x00000289BA3CC000-memory.dmp

Download

memory/2212-54-0x0000028352870000-0x000002835288C000-memory.dmp

Download

memory/2212-53-0x0000028352840000-0x000002835284A000-memory.dmp

Download

memory/2212-55-0x0000028352850000-0x000002835285A000-memory.dmp

Download

memory/2212-56-0x0000028352CC0000-0x0000028352CDA000-memory.dmp

Download

memory/2212-57-0x0000028352860000-0x0000028352868000-memory.dmp

Download

memory/2212-58-0x0000028352CA0000-0x0000028352CA6000-memory.dmp

Download

memory/2212-59-0x0000028352CB0000-0x0000028352CBA000-memory.dmp

Download

memory/2212-52-0x0000028352AA0000-0x0000028352B55000-memory.dmp

Download

memory/2212-22-0x0000028351DB0000-0x0000028351DD2000-memory.dmp

Download