52e0dd2bb331bc536fed5b9125029c980243b3c279f20b7a50c2f21e60729bf9

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_ff1215e6c9099db5417a7f1c8f830e65_icedid_njrat_stealc.exe
Size 6.9MB
Sample260830-3sp3nsbl9v
SHA256 52e0dd2bb331bc536fed5b9125029c980243b3c279f20b7a50c2f21e60729bf9
MD5 ff1215e6c9099db5417a7f1c8f830e65
SHA1 703cf1aa779f92da863f3f297a7eae600b2d6826
SHA512 5c9e73e4b2d7b91c2e8f3c4fe2a54b1f0a2a5345c3a6a74ac0e35a302a44a9db7226a8947c3a7202b70700407c43fca8eb478fc24523f9b6b8b311df436a7014
SSDEEP 196608:M+hBtOkSxByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C0:btObNSG/lVrl3KExL3JzATzC0
TLSH
T1C976012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4540	powershell.exe
1612	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2976	PeerService.exe
5040	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2056	tasklist.exe
2764	tasklist.exe
5064	tasklist.exe
1728	tasklist.exe
2484	tasklist.exe
2148	tasklist.exe
2720	tasklist.exe
3144	tasklist.exe
2436	tasklist.exe
5204	tasklist.exe
2040	tasklist.exe
1908	tasklist.exe
1360	tasklist.exe
2532	tasklist.exe
2868	tasklist.exe
3744	tasklist.exe
5928	tasklist.exe
2168	tasklist.exe
4804	tasklist.exe
3252	tasklist.exe
4560	tasklist.exe
1092	tasklist.exe
4588	tasklist.exe
5684	tasklist.exe
4520	tasklist.exe
4440	tasklist.exe
3432	tasklist.exe
3408	tasklist.exe
4564	tasklist.exe
1672	tasklist.exe
3240	tasklist.exe
1720	tasklist.exe
2984	tasklist.exe
4964	tasklist.exe
3004	tasklist.exe
2004	tasklist.exe
3456	tasklist.exe
1020	tasklist.exe
1376	tasklist.exe
4576	tasklist.exe
2436	tasklist.exe
5980	tasklist.exe
2492	tasklist.exe
4600	tasklist.exe
3556	tasklist.exe
4128	tasklist.exe
5064	tasklist.exe
5648	tasklist.exe
1168	tasklist.exe
1480	tasklist.exe
2144	tasklist.exe
1488	tasklist.exe
824	tasklist.exe
4876	tasklist.exe
4480	tasklist.exe
4240	tasklist.exe
3596	tasklist.exe
2864	tasklist.exe
2804	tasklist.exe
5012	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6112	cmd.exe
4364	cmd.exe
4372	cmd.exe
4140	cmd.exe
5896	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
5044	timeout.exe
952	timeout.exe
5900	timeout.exe
1988	timeout.exe
5712	timeout.exe
5776	timeout.exe
3164	timeout.exe
4488	timeout.exe
3960	timeout.exe
1072	timeout.exe
3612	timeout.exe
2636	timeout.exe
5036	timeout.exe
5272	timeout.exe
2560	timeout.exe
2432	timeout.exe
5416	timeout.exe
1728	timeout.exe
2720	timeout.exe
1504	timeout.exe
1380	timeout.exe
2840	timeout.exe
2420	timeout.exe
3124	timeout.exe
5652	timeout.exe
3816	timeout.exe
3312	timeout.exe
3000	timeout.exe
3472	timeout.exe
6052	timeout.exe
4504	timeout.exe
2088	timeout.exe
1280	timeout.exe
1800	timeout.exe
1900	timeout.exe
5864	timeout.exe
4484	timeout.exe
1884	timeout.exe
5112	timeout.exe
2540	timeout.exe
2688	timeout.exe
1436	timeout.exe
824	timeout.exe
5420	timeout.exe
1020	timeout.exe
5044	timeout.exe
2548	timeout.exe
4548	timeout.exe
2844	timeout.exe
6048	timeout.exe
2156	timeout.exe
3260	timeout.exe
4128	timeout.exe
4468	timeout.exe
4612	timeout.exe
5192	timeout.exe
4360	timeout.exe
4108	timeout.exe
5808	timeout.exe
5136	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4540	powershell.exe
4540	powershell.exe
4540	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	tasklist.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	3556	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4540	powershell.exe
Token: SeSecurityPrivilege	4540	powershell.exe
Token: SeTakeOwnershipPrivilege	4540	powershell.exe
Token: SeLoadDriverPrivilege	4540	powershell.exe
Token: SeSystemProfilePrivilege	4540	powershell.exe
Token: SeSystemtimePrivilege	4540	powershell.exe
Token: SeProfSingleProcessPrivilege	4540	powershell.exe
Token: SeIncBasePriorityPrivilege	4540	powershell.exe
Token: SeCreatePagefilePrivilege	4540	powershell.exe
Token: SeBackupPrivilege	4540	powershell.exe
Token: SeRestorePrivilege	4540	powershell.exe
Token: SeShutdownPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeSystemEnvironmentPrivilege	4540	powershell.exe
Token: SeRemoteShutdownPrivilege	4540	powershell.exe
Token: SeUndockPrivilege	4540	powershell.exe
Token: SeManageVolumePrivilege	4540	powershell.exe
Token: 33	4540	powershell.exe
Token: 34	4540	powershell.exe
Token: 35	4540	powershell.exe
Token: 36	4540	powershell.exe
Token: SeIncreaseQuotaPrivilege	1612	powershell.exe
Token: SeSecurityPrivilege	1612	powershell.exe
Token: SeTakeOwnershipPrivilege	1612	powershell.exe
Token: SeLoadDriverPrivilege	1612	powershell.exe
Token: SeSystemProfilePrivilege	1612	powershell.exe
Token: SeSystemtimePrivilege	1612	powershell.exe
Token: SeProfSingleProcessPrivilege	1612	powershell.exe
Token: SeIncBasePriorityPrivilege	1612	powershell.exe
Token: SeCreatePagefilePrivilege	1612	powershell.exe
Token: SeBackupPrivilege	1612	powershell.exe
Token: SeRestorePrivilege	1612	powershell.exe
Token: SeShutdownPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeSystemEnvironmentPrivilege	1612	powershell.exe
Token: SeRemoteShutdownPrivilege	1612	powershell.exe
Token: SeUndockPrivilege	1612	powershell.exe
Token: SeManageVolumePrivilege	1612	powershell.exe
Token: 33	1612	powershell.exe
Token: 34	1612	powershell.exe
Token: 35	1612	powershell.exe
Token: 36	1612	powershell.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	5928	tasklist.exe
Token: SeDebugPrivilege	1376	tasklist.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	5980	tasklist.exe
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeDebugPrivilege	1728	tasklist.exe
Token: SeDebugPrivilege	4804	tasklist.exe
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	1092	tasklist.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	3004	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4372	3216	2026-08-30_ff1215e6c9099db5417a7f1c8f830e65_icedid_njrat_stealc.exe	90
PID 4372 wrote to memory of 5076	4372	cmd.exe	92
PID 3216 wrote to memory of 5040	3216	2026-08-30_ff1215e6c9099db5417a7f1c8f830e65_icedid_njrat_stealc.exe	95
PID 2976 wrote to memory of 5896	2976	PeerService.exe	97
PID 2976 wrote to memory of 4140	2976	PeerService.exe	98
PID 5040 wrote to memory of 6112	5040	PeerService.exe	102
PID 5040 wrote to memory of 4364	5040	PeerService.exe	104
PID 4140 wrote to memory of 2056	4140	cmd.exe	106
PID 4140 wrote to memory of 4972	4140	cmd.exe	107
PID 5896 wrote to memory of 4540	5896	cmd.exe	108
PID 6112 wrote to memory of 1612	6112	cmd.exe	109
PID 4364 wrote to memory of 3556	4364	cmd.exe	110
PID 4364 wrote to memory of 5112	4364	cmd.exe	111
PID 4364 wrote to memory of 3612	4364	cmd.exe	114
PID 4140 wrote to memory of 2540	4140	cmd.exe	115
PID 4364 wrote to memory of 5064	4364	cmd.exe	116
PID 4364 wrote to memory of 5052	4364	cmd.exe	117
PID 4364 wrote to memory of 2688	4364	cmd.exe	118
PID 4140 wrote to memory of 2168	4140	cmd.exe	119
PID 4140 wrote to memory of 3004	4140	cmd.exe	120
PID 4140 wrote to memory of 5044	4140	cmd.exe	121
PID 4364 wrote to memory of 3144	4364	cmd.exe	122
PID 4364 wrote to memory of 1008	4364	cmd.exe	123
PID 4364 wrote to memory of 5808	4364	cmd.exe	124
PID 4140 wrote to memory of 1672	4140	cmd.exe	125
PID 4140 wrote to memory of 1900	4140	cmd.exe	126
PID 4140 wrote to memory of 5864	4140	cmd.exe	127
PID 4364 wrote to memory of 5928	4364	cmd.exe	128
PID 4364 wrote to memory of 5744	4364	cmd.exe	129
PID 4364 wrote to memory of 2636	4364	cmd.exe	130
PID 4140 wrote to memory of 1376	4140	cmd.exe	131
PID 4140 wrote to memory of 3080	4140	cmd.exe	132
PID 4140 wrote to memory of 5900	4140	cmd.exe	133
PID 4364 wrote to memory of 4480	4364	cmd.exe	134
PID 4364 wrote to memory of 612	4364	cmd.exe	135
PID 4364 wrote to memory of 6052	4364	cmd.exe	136
PID 4140 wrote to memory of 5980	4140	cmd.exe	137
PID 4140 wrote to memory of 4088	4140	cmd.exe	138
PID 4140 wrote to memory of 5192	4140	cmd.exe	139
PID 4364 wrote to memory of 3596	4364	cmd.exe	140
PID 4364 wrote to memory of 5412	4364	cmd.exe	141
PID 4364 wrote to memory of 5136	4364	cmd.exe	142
PID 4140 wrote to memory of 4964	4140	cmd.exe	144
PID 4140 wrote to memory of 4888	4140	cmd.exe	145
PID 4140 wrote to memory of 4484	4140	cmd.exe	146
PID 4364 wrote to memory of 1728	4364	cmd.exe	147
PID 4364 wrote to memory of 3220	4364	cmd.exe	148
PID 4364 wrote to memory of 1436	4364	cmd.exe	149
PID 4140 wrote to memory of 4804	4140	cmd.exe	150
PID 4140 wrote to memory of 2244	4140	cmd.exe	151
PID 4140 wrote to memory of 4504	4140	cmd.exe	152
PID 4364 wrote to memory of 2764	4364	cmd.exe	153
PID 4364 wrote to memory of 1488	4364	cmd.exe	154
PID 4364 wrote to memory of 2720	4364	cmd.exe	155
PID 4140 wrote to memory of 3252	4140	cmd.exe	156
PID 4140 wrote to memory of 2016	4140	cmd.exe	157
PID 4140 wrote to memory of 824	4140	cmd.exe	158
PID 4364 wrote to memory of 4560	4364	cmd.exe	159
PID 4364 wrote to memory of 1860	4364	cmd.exe	160
PID 4364 wrote to memory of 5652	4364	cmd.exe	161
PID 4140 wrote to memory of 4128	4140	cmd.exe	162
PID 4140 wrote to memory of 5892	4140	cmd.exe	163
PID 4140 wrote to memory of 2088	4140	cmd.exe	164
PID 4364 wrote to memory of 1092	4364	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-30_ff1215e6c9099db5417a7f1c8f830e65_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_ff1215e6c9099db5417a7f1c8f830e65_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5076
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3556
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5052
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1008
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5928
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5744
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2636
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4480
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3596
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2764
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4560
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1092
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3000
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2532
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4480
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5684
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2236
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2608
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2804
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3604
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3580
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3004
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4760
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1168
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5972
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2156
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4600
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2724
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1480
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5676
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1020
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:264
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3472

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5044
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2016
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5892
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:616
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1376
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5420
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2740
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2432
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2864
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5924
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1020
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2868
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3124
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4956
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4440
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5080
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3960
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5044
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5928
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2040
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4848
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1908
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5012
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1820
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1728
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1488
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4612
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2148
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4504
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x0hyfoky.ahb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x0hyfoky.ahb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.9MB
SHA256 321e43110c2b2961c1f33c8d53f90d2d1443e6abca60ed4a8e6dbdb067bf9172
MD5 5fe152398be7b7fe4f585e16fee1fc47
SHA1 b23d195f0b5dcc4b3066db5fa58fb21e77ff57bb
SHA512 3fd0ab9e1369f44d65fcfdd401849f97ff1b663c6cc84447c86bedaee26033262b59ea7b7bada40b0af99ab1a6b5b7b0f35e9fc7a39c3405a97d3be73c973a22
SSDEEP 196608:M+hBtOkS9ByQyVG/uzGNVyAl3K8fCGnbP3JzATC4C6:btO/NSG/lVrl3KExL3JzATzC6
TLSH
T15676012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4540-14-0x00000242C9D70000-0x00000242C9D92000-memory.dmp

Download

memory/4540-20-0x00000242E2260000-0x00000242E2312000-memory.dmp

Download

memory/4540-19-0x00000242E2240000-0x00000242E225E000-memory.dmp

Download

memory/4540-21-0x00000242E2320000-0x00000242E232A000-memory.dmp

Download