f6c96fb7083185fd059cfdd5d17ff18fd5a4b41ac484643c80e5b4f5e7c5715a

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe
Size 6.5MB
Sample260827-r4tpfsam71
SHA256 f6c96fb7083185fd059cfdd5d17ff18fd5a4b41ac484643c80e5b4f5e7c5715a
MD5 76a4108a11fb56eee831966e3db7df2a
SHA1 51d4d8c2bc000b41f1fb6cce0f4eef86a49d6d95
SHA512 8de6a3c4ed7cd4742aa8a861e1ba9513b9089e6a99ab4f497af34b0043ecc390aafbb458e808de35daa0e03758514a0c674996c1511024767e334df0c6e1995b
SSDEEP 196608:s+hBtOkStByQyVG/uzGNVyAl3K8fCGnbP3JzATC47:7tO/NSG/lVrl3KExL3JzATz7
TLSH
T1C966012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe
5100	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5544	PeerService.exe
5552	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1312	tasklist.exe
824	tasklist.exe
1556	tasklist.exe
5520	tasklist.exe
3284	tasklist.exe
1272	tasklist.exe
3008	tasklist.exe
4672	tasklist.exe
1976	tasklist.exe
480	tasklist.exe
1528	tasklist.exe
2268	tasklist.exe
5492	tasklist.exe
4628	tasklist.exe
4000	tasklist.exe
3940	tasklist.exe
4936	tasklist.exe
4768	tasklist.exe
712	tasklist.exe
3820	tasklist.exe
5152	tasklist.exe
2568	tasklist.exe
2848	tasklist.exe
4492	tasklist.exe
2532	tasklist.exe
5984	tasklist.exe
1640	tasklist.exe
4632	tasklist.exe
4100	tasklist.exe
2236	tasklist.exe
2132	tasklist.exe
2596	tasklist.exe
4932	tasklist.exe
5788	tasklist.exe
4308	tasklist.exe
3644	tasklist.exe
4568	tasklist.exe
5764	tasklist.exe
2644	tasklist.exe
5524	tasklist.exe
2576	tasklist.exe
4188	tasklist.exe
4992	tasklist.exe
3620	tasklist.exe
3336	tasklist.exe
4752	tasklist.exe
1244	tasklist.exe
4556	tasklist.exe
2908	tasklist.exe
3984	tasklist.exe
3708	tasklist.exe
2880	tasklist.exe
5588	tasklist.exe
4712	tasklist.exe
4448	tasklist.exe
4248	tasklist.exe
3964	tasklist.exe
2132	tasklist.exe
5384	tasklist.exe
2332	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3688	cmd.exe
2536	cmd.exe
4344	cmd.exe
2308	cmd.exe
5204	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
4460	timeout.exe
556	timeout.exe
3164	timeout.exe
4880	timeout.exe
1668	timeout.exe
5660	timeout.exe
4108	timeout.exe
4560	timeout.exe
3936	timeout.exe
1620	timeout.exe
4152	timeout.exe
792	timeout.exe
3628	timeout.exe
5220	timeout.exe
3960	timeout.exe
2312	timeout.exe
2760	timeout.exe
2052	timeout.exe
3008	timeout.exe
4928	timeout.exe
3920	timeout.exe
4108	timeout.exe
3472	timeout.exe
4644	timeout.exe
4936	timeout.exe
3724	timeout.exe
5532	timeout.exe
4788	timeout.exe
2576	timeout.exe
1668	timeout.exe
2760	timeout.exe
4644	timeout.exe
4940	timeout.exe
708	timeout.exe
3836	timeout.exe
720	timeout.exe
4152	timeout.exe
1152	timeout.exe
2576	timeout.exe
2736	timeout.exe
6076	timeout.exe
1668	timeout.exe
3920	timeout.exe
5668	timeout.exe
2112	timeout.exe
2432	timeout.exe
5664	timeout.exe
3840	timeout.exe
4180	timeout.exe
5548	timeout.exe
1488	timeout.exe
4512	timeout.exe
752	timeout.exe
2672	timeout.exe
2872	timeout.exe
3708	timeout.exe
5060	timeout.exe
6004	timeout.exe
4792	timeout.exe
3644	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2132	tasklist.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeIncreaseQuotaPrivilege	2868	powershell.exe
Token: SeSecurityPrivilege	2868	powershell.exe
Token: SeTakeOwnershipPrivilege	2868	powershell.exe
Token: SeLoadDriverPrivilege	2868	powershell.exe
Token: SeSystemProfilePrivilege	2868	powershell.exe
Token: SeSystemtimePrivilege	2868	powershell.exe
Token: SeProfSingleProcessPrivilege	2868	powershell.exe
Token: SeIncBasePriorityPrivilege	2868	powershell.exe
Token: SeCreatePagefilePrivilege	2868	powershell.exe
Token: SeBackupPrivilege	2868	powershell.exe
Token: SeRestorePrivilege	2868	powershell.exe
Token: SeShutdownPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeSystemEnvironmentPrivilege	2868	powershell.exe
Token: SeRemoteShutdownPrivilege	2868	powershell.exe
Token: SeUndockPrivilege	2868	powershell.exe
Token: SeManageVolumePrivilege	2868	powershell.exe
Token: 33	2868	powershell.exe
Token: 34	2868	powershell.exe
Token: 35	2868	powershell.exe
Token: 36	2868	powershell.exe
Token: SeIncreaseQuotaPrivilege	5100	powershell.exe
Token: SeSecurityPrivilege	5100	powershell.exe
Token: SeTakeOwnershipPrivilege	5100	powershell.exe
Token: SeLoadDriverPrivilege	5100	powershell.exe
Token: SeSystemProfilePrivilege	5100	powershell.exe
Token: SeSystemtimePrivilege	5100	powershell.exe
Token: SeProfSingleProcessPrivilege	5100	powershell.exe
Token: SeIncBasePriorityPrivilege	5100	powershell.exe
Token: SeCreatePagefilePrivilege	5100	powershell.exe
Token: SeBackupPrivilege	5100	powershell.exe
Token: SeRestorePrivilege	5100	powershell.exe
Token: SeShutdownPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeSystemEnvironmentPrivilege	5100	powershell.exe
Token: SeRemoteShutdownPrivilege	5100	powershell.exe
Token: SeUndockPrivilege	5100	powershell.exe
Token: SeManageVolumePrivilege	5100	powershell.exe
Token: 33	5100	powershell.exe
Token: 34	5100	powershell.exe
Token: 35	5100	powershell.exe
Token: 36	5100	powershell.exe
Token: SeDebugPrivilege	712	tasklist.exe
Token: SeDebugPrivilege	1976	tasklist.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	4712	tasklist.exe
Token: SeDebugPrivilege	2332	tasklist.exe
Token: SeDebugPrivilege	4000	tasklist.exe
Token: SeDebugPrivilege	1312	tasklist.exe
Token: SeDebugPrivilege	3940	tasklist.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeDebugPrivilege	3708	tasklist.exe
Token: SeDebugPrivilege	5984	tasklist.exe
Token: SeDebugPrivilege	4448	tasklist.exe
Token: SeDebugPrivilege	3820	tasklist.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	5152	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3688	4740	2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe	90
PID 3688 wrote to memory of 5604	3688	cmd.exe	92
PID 4740 wrote to memory of 5544	4740	2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe	94
PID 5544 wrote to memory of 4344	5544	PeerService.exe	96
PID 5544 wrote to memory of 2536	5544	PeerService.exe	97
PID 5552 wrote to memory of 5204	5552	PeerService.exe	102
PID 5552 wrote to memory of 2308	5552	PeerService.exe	103
PID 2536 wrote to memory of 3984	2536	cmd.exe	105
PID 4344 wrote to memory of 2868	4344	cmd.exe	106
PID 2536 wrote to memory of 2808	2536	cmd.exe	108
PID 2308 wrote to memory of 2132	2308	cmd.exe	109
PID 2308 wrote to memory of 5172	2308	cmd.exe	110
PID 5204 wrote to memory of 5100	5204	cmd.exe	111
PID 2536 wrote to memory of 4152	2536	cmd.exe	114
PID 2308 wrote to memory of 4940	2308	cmd.exe	115
PID 2308 wrote to memory of 712	2308	cmd.exe	116
PID 2308 wrote to memory of 4304	2308	cmd.exe	117
PID 2536 wrote to memory of 1976	2536	cmd.exe	118
PID 2536 wrote to memory of 1408	2536	cmd.exe	119
PID 2308 wrote to memory of 4108	2308	cmd.exe	120
PID 2536 wrote to memory of 4560	2536	cmd.exe	121
PID 2536 wrote to memory of 5384	2536	cmd.exe	122
PID 2536 wrote to memory of 3508	2536	cmd.exe	123
PID 2308 wrote to memory of 4712	2308	cmd.exe	124
PID 2308 wrote to memory of 4248	2308	cmd.exe	125
PID 2536 wrote to memory of 1668	2536	cmd.exe	126
PID 2308 wrote to memory of 6004	2308	cmd.exe	127
PID 2308 wrote to memory of 2332	2308	cmd.exe	128
PID 2308 wrote to memory of 4412	2308	cmd.exe	129
PID 2536 wrote to memory of 4000	2536	cmd.exe	130
PID 2536 wrote to memory of 4924	2536	cmd.exe	131
PID 2308 wrote to memory of 2576	2308	cmd.exe	132
PID 2536 wrote to memory of 4880	2536	cmd.exe	133
PID 2536 wrote to memory of 1312	2536	cmd.exe	134
PID 2536 wrote to memory of 4340	2536	cmd.exe	135
PID 2308 wrote to memory of 3940	2308	cmd.exe	136
PID 2308 wrote to memory of 5760	2308	cmd.exe	137
PID 2536 wrote to memory of 4512	2536	cmd.exe	138
PID 2308 wrote to memory of 4460	2308	cmd.exe	139
PID 2308 wrote to memory of 4188	2308	cmd.exe	140
PID 2308 wrote to memory of 5968	2308	cmd.exe	141
PID 2536 wrote to memory of 4992	2536	cmd.exe	142
PID 2536 wrote to memory of 5184	2536	cmd.exe	143
PID 2308 wrote to memory of 2112	2308	cmd.exe	144
PID 2536 wrote to memory of 3936	2536	cmd.exe	145
PID 2308 wrote to memory of 3708	2308	cmd.exe	147
PID 2308 wrote to memory of 5648	2308	cmd.exe	148
PID 2536 wrote to memory of 5984	2536	cmd.exe	149
PID 2536 wrote to memory of 2964	2536	cmd.exe	150
PID 2308 wrote to memory of 4644	2308	cmd.exe	151
PID 2536 wrote to memory of 2432	2536	cmd.exe	152
PID 2536 wrote to memory of 4448	2536	cmd.exe	153
PID 2308 wrote to memory of 3820	2308	cmd.exe	154
PID 2536 wrote to memory of 5176	2536	cmd.exe	155
PID 2308 wrote to memory of 5864	2308	cmd.exe	156
PID 2536 wrote to memory of 708	2536	cmd.exe	157
PID 2308 wrote to memory of 3836	2308	cmd.exe	158
PID 2536 wrote to memory of 3620	2536	cmd.exe	159
PID 2536 wrote to memory of 3168	2536	cmd.exe	160
PID 2308 wrote to memory of 2644	2308	cmd.exe	161
PID 2308 wrote to memory of 3844	2308	cmd.exe	162
PID 2536 wrote to memory of 3960	2536	cmd.exe	163
PID 2308 wrote to memory of 3008	2308	cmd.exe	164
PID 2308 wrote to memory of 5152	2308	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_76a4108a11fb56eee831966e3db7df2a_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5604
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2808
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1976
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5384
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3508
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4924
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4880
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1312
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5176
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3620
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3168
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5524
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2268
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4308
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4108
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5788
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2296
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3284
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3644
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4992
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2568
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2748
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6120
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1272
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3000
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3008
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2244
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5152
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2264
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4672
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4568
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4504
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3964
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5760
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5764
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2052

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4412
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2576
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5760
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4460
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5968
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5648
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5864
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3844
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5520
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4152
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:480
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1152
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4768
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4000
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3336
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2604
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5516
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3756
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5192
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:792
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1640
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1616
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2596
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4544
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3628
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2908
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2096
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4628
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4308
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4248
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5048
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_blt1rihk.fyo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blt1rihk.fyo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 5.1MB
SHA256 5cbf85a6d82784aab9e811faa3d93f44b1b566f071140f18bc2d309a300b09e9
MD5 23e97148be1f15401896ea85707023fd
SHA1 8a1115fb4d49cfef2c835afe3c44f7d7471ab39a
SHA512 9abf5e37384e65c7a2c80ce4501e7ad79aa235ea9244907a4d12c8e8582e85c54b2b2fa8f6e2a7d1c7f613ad0cb09ae3022f08f35a45dc15435f81a0b1d4c902
SSDEEP 98304:M+hBp75lKkBcUWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQk:M+hBtOkSzByQyVG/uzGNVyAl3K8fCGk
TLSH
T14536F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2868-14-0x00000201AEBD0000-0x00000201AEBF2000-memory.dmp

Download

memory/2868-20-0x00000201AEEA0000-0x00000201AEF52000-memory.dmp

Download

memory/2868-19-0x00000201AEE80000-0x00000201AEE9E000-memory.dmp

Download

memory/2868-21-0x00000201AEE70000-0x00000201AEE7A000-memory.dmp

Download