303a95d6e9d66052e6fdf26edce679aff006d3c3d6e55ef6defc0376221f1ac4

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fbb8cddd3d71d98ebf8936181913602f_icedid_njrat_stealc.exe
Size 2.0MB
Sample260830-2ydfdstwht
SHA256 303a95d6e9d66052e6fdf26edce679aff006d3c3d6e55ef6defc0376221f1ac4
MD5 fbb8cddd3d71d98ebf8936181913602f
SHA1 0143d63494f66dc0907d1fa432427f786610c32f
SHA512 000c9dfddd67dd34cc576161fe45554583459cb367c15d6b5620dc30d47adaccf97fbc5562b7151b75b7d839468df086b6bea33545dcb730f710822ee7a65571
SSDEEP 24576:Ro++M/XJ9PSyTYkFxh7TZhIig8pFJsXHW5KQxpzv/HFFSHpO0H:C++Mx9P9FXZhIl8pFJ8HsKkpLH/SHL
TLSH
T15DA57D2BB26901E8E1BFD17CC9165907EBB1780503A0A7DF12E047A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3260	powershell.exe
5328	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4676	PeerService.exe
4540	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3936	tasklist.exe
2988	tasklist.exe
4644	tasklist.exe
5524	tasklist.exe
2536	tasklist.exe
3420	tasklist.exe
1980	tasklist.exe
4848	tasklist.exe
3740	tasklist.exe
4932	tasklist.exe
2140	tasklist.exe
1392	tasklist.exe
4760	tasklist.exe
3988	tasklist.exe
1468	tasklist.exe
5976	tasklist.exe
4288	tasklist.exe
2264	tasklist.exe
3292	tasklist.exe
3268	tasklist.exe
5808	tasklist.exe
4916	tasklist.exe
2760	tasklist.exe
2960	tasklist.exe
2296	tasklist.exe
3768	tasklist.exe
1392	tasklist.exe
3532	tasklist.exe
1048	tasklist.exe
5836	tasklist.exe
4348	tasklist.exe
4224	tasklist.exe
2140	tasklist.exe
3068	tasklist.exe
1980	tasklist.exe
2016	tasklist.exe
2748	tasklist.exe
2828	tasklist.exe
5424	tasklist.exe
2100	tasklist.exe
824	tasklist.exe
4292	tasklist.exe
1904	tasklist.exe
3640	tasklist.exe
484	tasklist.exe
3260	tasklist.exe
1892	tasklist.exe
3784	tasklist.exe
4552	tasklist.exe
1228	tasklist.exe
628	tasklist.exe
2920	tasklist.exe
360	tasklist.exe
2544	tasklist.exe
2968	tasklist.exe
4520	tasklist.exe
1064	tasklist.exe
3532	tasklist.exe
5616	tasklist.exe
5772	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4176	cmd.exe
3388	cmd.exe
3408	cmd.exe
5732	cmd.exe
5804	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2732	timeout.exe
3372	timeout.exe
4216	timeout.exe
1964	timeout.exe
1332	timeout.exe
3724	timeout.exe
2040	timeout.exe
352	timeout.exe
4824	timeout.exe
5960	timeout.exe
1764	timeout.exe
5472	timeout.exe
1184	timeout.exe
4320	timeout.exe
3768	timeout.exe
3492	timeout.exe
4588	timeout.exe
5628	timeout.exe
1180	timeout.exe
2752	timeout.exe
3888	timeout.exe
3228	timeout.exe
1896	timeout.exe
3624	timeout.exe
5472	timeout.exe
5340	timeout.exe
2664	timeout.exe
4784	timeout.exe
3728	timeout.exe
2692	timeout.exe
964	timeout.exe
1804	timeout.exe
4820	timeout.exe
5192	timeout.exe
1568	timeout.exe
5172	timeout.exe
1952	timeout.exe
5116	timeout.exe
5196	timeout.exe
460	timeout.exe
5456	timeout.exe
5500	timeout.exe
4936	timeout.exe
5016	timeout.exe
4208	timeout.exe
3204	timeout.exe
724	timeout.exe
2500	timeout.exe
4232	timeout.exe
5172	timeout.exe
4600	timeout.exe
4968	timeout.exe
3316	timeout.exe
5720	timeout.exe
2916	timeout.exe
5404	timeout.exe
5880	timeout.exe
5728	timeout.exe
4728	timeout.exe
5480	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3260	powershell.exe
3260	powershell.exe
3260	powershell.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	4760	tasklist.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeIncreaseQuotaPrivilege	3260	powershell.exe
Token: SeSecurityPrivilege	3260	powershell.exe
Token: SeTakeOwnershipPrivilege	3260	powershell.exe
Token: SeLoadDriverPrivilege	3260	powershell.exe
Token: SeSystemProfilePrivilege	3260	powershell.exe
Token: SeSystemtimePrivilege	3260	powershell.exe
Token: SeProfSingleProcessPrivilege	3260	powershell.exe
Token: SeIncBasePriorityPrivilege	3260	powershell.exe
Token: SeCreatePagefilePrivilege	3260	powershell.exe
Token: SeBackupPrivilege	3260	powershell.exe
Token: SeRestorePrivilege	3260	powershell.exe
Token: SeShutdownPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeSystemEnvironmentPrivilege	3260	powershell.exe
Token: SeRemoteShutdownPrivilege	3260	powershell.exe
Token: SeUndockPrivilege	3260	powershell.exe
Token: SeManageVolumePrivilege	3260	powershell.exe
Token: 33	3260	powershell.exe
Token: 34	3260	powershell.exe
Token: 35	3260	powershell.exe
Token: 36	3260	powershell.exe
Token: SeIncreaseQuotaPrivilege	5328	powershell.exe
Token: SeSecurityPrivilege	5328	powershell.exe
Token: SeTakeOwnershipPrivilege	5328	powershell.exe
Token: SeLoadDriverPrivilege	5328	powershell.exe
Token: SeSystemProfilePrivilege	5328	powershell.exe
Token: SeSystemtimePrivilege	5328	powershell.exe
Token: SeProfSingleProcessPrivilege	5328	powershell.exe
Token: SeIncBasePriorityPrivilege	5328	powershell.exe
Token: SeCreatePagefilePrivilege	5328	powershell.exe
Token: SeBackupPrivilege	5328	powershell.exe
Token: SeRestorePrivilege	5328	powershell.exe
Token: SeShutdownPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeSystemEnvironmentPrivilege	5328	powershell.exe
Token: SeRemoteShutdownPrivilege	5328	powershell.exe
Token: SeUndockPrivilege	5328	powershell.exe
Token: SeManageVolumePrivilege	5328	powershell.exe
Token: 33	5328	powershell.exe
Token: 34	5328	powershell.exe
Token: 35	5328	powershell.exe
Token: 36	5328	powershell.exe
Token: SeDebugPrivilege	5976	tasklist.exe
Token: SeDebugPrivilege	4848	tasklist.exe
Token: SeDebugPrivilege	5424	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	1048	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	2748	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	3640	tasklist.exe
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	3740	tasklist.exe
Token: SeDebugPrivilege	2140	tasklist.exe
Token: SeDebugPrivilege	3260	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3388	1052	2026-08-29_fbb8cddd3d71d98ebf8936181913602f_icedid_njrat_stealc.exe	90
PID 3388 wrote to memory of 4880	3388	cmd.exe	92
PID 1052 wrote to memory of 4540	1052	2026-08-29_fbb8cddd3d71d98ebf8936181913602f_icedid_njrat_stealc.exe	96
PID 4676 wrote to memory of 5732	4676	PeerService.exe	98
PID 4676 wrote to memory of 3408	4676	PeerService.exe	99
PID 5732 wrote to memory of 3260	5732	cmd.exe	102
PID 4540 wrote to memory of 4176	4540	PeerService.exe	103
PID 4540 wrote to memory of 5804	4540	PeerService.exe	104
PID 3408 wrote to memory of 2296	3408	cmd.exe	106
PID 3408 wrote to memory of 4280	3408	cmd.exe	108
PID 5804 wrote to memory of 4760	5804	cmd.exe	110
PID 5804 wrote to memory of 5660	5804	cmd.exe	111
PID 4176 wrote to memory of 5328	4176	cmd.exe	112
PID 3408 wrote to memory of 5016	3408	cmd.exe	114
PID 5804 wrote to memory of 2916	5804	cmd.exe	115
PID 3408 wrote to memory of 5976	3408	cmd.exe	116
PID 3408 wrote to memory of 5948	3408	cmd.exe	117
PID 5804 wrote to memory of 4848	5804	cmd.exe	118
PID 5804 wrote to memory of 3204	5804	cmd.exe	119
PID 3408 wrote to memory of 4588	3408	cmd.exe	120
PID 5804 wrote to memory of 5116	5804	cmd.exe	121
PID 3408 wrote to memory of 5424	3408	cmd.exe	122
PID 3408 wrote to memory of 3852	3408	cmd.exe	123
PID 5804 wrote to memory of 2100	5804	cmd.exe	124
PID 5804 wrote to memory of 1988	5804	cmd.exe	125
PID 3408 wrote to memory of 1896	3408	cmd.exe	126
PID 5804 wrote to memory of 5960	5804	cmd.exe	127
PID 5804 wrote to memory of 4288	5804	cmd.exe	128
PID 5804 wrote to memory of 1468	5804	cmd.exe	129
PID 3408 wrote to memory of 2016	3408	cmd.exe	130
PID 3408 wrote to memory of 2664	3408	cmd.exe	131
PID 3408 wrote to memory of 4232	3408	cmd.exe	132
PID 5804 wrote to memory of 1964	5804	cmd.exe	133
PID 3408 wrote to memory of 4916	3408	cmd.exe	134
PID 3408 wrote to memory of 2204	3408	cmd.exe	135
PID 5804 wrote to memory of 3988	5804	cmd.exe	136
PID 5804 wrote to memory of 1064	5804	cmd.exe	137
PID 3408 wrote to memory of 5340	3408	cmd.exe	138
PID 5804 wrote to memory of 1764	5804	cmd.exe	139
PID 3408 wrote to memory of 1048	3408	cmd.exe	140
PID 5804 wrote to memory of 2968	5804	cmd.exe	141
PID 3408 wrote to memory of 5668	3408	cmd.exe	142
PID 5804 wrote to memory of 4584	5804	cmd.exe	143
PID 3408 wrote to memory of 4208	3408	cmd.exe	144
PID 5804 wrote to memory of 5628	5804	cmd.exe	145
PID 3408 wrote to memory of 5524	3408	cmd.exe	147
PID 3408 wrote to memory of 4520	3408	cmd.exe	148
PID 5804 wrote to memory of 2748	5804	cmd.exe	149
PID 5804 wrote to memory of 756	5804	cmd.exe	150
PID 3408 wrote to memory of 4936	3408	cmd.exe	151
PID 5804 wrote to memory of 5404	5804	cmd.exe	152
PID 3408 wrote to memory of 2760	3408	cmd.exe	153
PID 3408 wrote to memory of 1288	3408	cmd.exe	154
PID 5804 wrote to memory of 3640	5804	cmd.exe	155
PID 5804 wrote to memory of 2532	5804	cmd.exe	156
PID 3408 wrote to memory of 5880	3408	cmd.exe	157
PID 5804 wrote to memory of 1180	5804	cmd.exe	158
PID 5804 wrote to memory of 2264	5804	cmd.exe	159
PID 5804 wrote to memory of 2644	5804	cmd.exe	160
PID 3408 wrote to memory of 3740	3408	cmd.exe	161
PID 3408 wrote to memory of 2080	3408	cmd.exe	162
PID 5804 wrote to memory of 4820	5804	cmd.exe	163
PID 3408 wrote to memory of 2752	3408	cmd.exe	164
PID 3408 wrote to memory of 2140	3408	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fbb8cddd3d71d98ebf8936181913602f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fbb8cddd3d71d98ebf8936181913602f_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2968
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4584
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2532
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3260
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4240
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3292
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4588
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3768
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2544
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2664
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3348
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4568
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3268
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2976
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5836
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2272
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1152
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5672
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3296
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4644
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:548
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4520
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4728

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4588
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1896
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2664
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2204
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1288
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5880
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4224
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1392
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5388
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1980
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2488
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3372
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3936
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3872
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5616
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4772
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:460
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2140
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3316
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1228
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3944
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4320
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:628
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1392
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5388
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4292
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5196
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3420
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4348
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_m5oooyxl.hb2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m5oooyxl.hb2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 5.0MB
SHA256 1af4c334a5960b664fcb2a71b7a5c2f861873e53867d9dd7ae8854e3e8f9639d
MD5 b0c7d3fd28a400f69d01b4cdc6539eb5
SHA1 d6a03e798528e2b848b402bb82a35393133b5c09
SHA512 8953f468c7a20f97499d5e498ee04c563b0740838392127bd0a00c672e7bf8b6ccd7e0a897f30ddbbe669feb6f5da47d2721249812de27fab209d099691d39ec
SSDEEP 98304:C+hx5LJlKkxsFWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCf:C+hxtekSoByQyVG/uzGNVyAl3K8fCf
TLSH
T19A36F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3260-14-0x0000013DE3420000-0x0000013DE3442000-memory.dmp

Download

memory/3260-20-0x0000013DE35E0000-0x0000013DE3692000-memory.dmp

Download

memory/3260-19-0x0000013DE35C0000-0x0000013DE35DE000-memory.dmp

Download

memory/3260-21-0x0000013DE36A0000-0x0000013DE36AA000-memory.dmp

Download