436fcb72247b82088936d12884403318cef4824b85ca976447065863c1b3b751

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe
Size 5.0MB
Sample260905-jbvr2sce92
SHA256 436fcb72247b82088936d12884403318cef4824b85ca976447065863c1b3b751
MD5 6e5bfca9c44a84110846c42c1333d794
SHA1 f7a7bbeeb5a9d4b2f34d0f8fe52a6e3b34e69113
SHA512 0a53f8f9919c6b69156b0476e4aeebe6641ce168bb2ed4e636efd02ee8745a8163217371689079ef17a0b75a1854ae3e7a94e33304250e864a6f29baa6932d2b
SSDEEP 98304:M+hxpLJlKkvs5WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQh:M+hx9ekEEByQyVG/uzGNVyAl3K8fCGh
TLSH
T11536F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4668	powershell.exe
3832	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
2732	PeerService.exe
4568	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4936	tasklist.exe
4496	tasklist.exe
2204	tasklist.exe
2492	tasklist.exe
5048	tasklist.exe
4708	tasklist.exe
2708	tasklist.exe
3580	tasklist.exe
2384	tasklist.exe
1804	tasklist.exe
3184	tasklist.exe
552	tasklist.exe
4044	tasklist.exe
1872	tasklist.exe
5068	tasklist.exe
2580	tasklist.exe
4432	tasklist.exe
4172	tasklist.exe
2540	tasklist.exe
908	tasklist.exe
3436	tasklist.exe
3468	tasklist.exe
876	tasklist.exe
3804	tasklist.exe
3168	tasklist.exe
3504	tasklist.exe
4196	tasklist.exe
2284	tasklist.exe
4204	tasklist.exe
3964	tasklist.exe
4640	tasklist.exe
4064	tasklist.exe
4772	tasklist.exe
2456	tasklist.exe
3480	tasklist.exe
2400	tasklist.exe
3348	tasklist.exe
2128	tasklist.exe
4752	tasklist.exe
2460	tasklist.exe
4972	tasklist.exe
2256	tasklist.exe
2724	tasklist.exe
4348	tasklist.exe
4800	tasklist.exe
3724	tasklist.exe
4444	tasklist.exe
1120	tasklist.exe
1692	tasklist.exe
3992	tasklist.exe
640	tasklist.exe
3456	tasklist.exe
4156	tasklist.exe
3272	tasklist.exe
3512	tasklist.exe
3536	tasklist.exe
2260	tasklist.exe
1800	tasklist.exe
1124	tasklist.exe
2556	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5116	cmd.exe
4360	cmd.exe
1200	cmd.exe
4420	cmd.exe
4084	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3236	timeout.exe
2632	timeout.exe
4624	timeout.exe
4972	timeout.exe
2844	timeout.exe
3492	timeout.exe
3296	timeout.exe
2292	timeout.exe
2416	timeout.exe
3496	timeout.exe
2784	timeout.exe
2564	timeout.exe
3908	timeout.exe
4496	timeout.exe
4452	timeout.exe
3360	timeout.exe
4328	timeout.exe
3628	timeout.exe
1232	timeout.exe
3608	timeout.exe
1704	timeout.exe
4888	timeout.exe
4680	timeout.exe
2668	timeout.exe
4964	timeout.exe
1456	timeout.exe
5052	timeout.exe
408	timeout.exe
1832	timeout.exe
2844	timeout.exe
2440	timeout.exe
4112	timeout.exe
4964	timeout.exe
2440	timeout.exe
2076	timeout.exe
4692	timeout.exe
212	timeout.exe
4292	timeout.exe
2128	timeout.exe
3992	timeout.exe
1332	timeout.exe
1800	timeout.exe
1340	timeout.exe
5020	timeout.exe
4284	timeout.exe
972	timeout.exe
2076	timeout.exe
1456	timeout.exe
2416	timeout.exe
1376	timeout.exe
1012	timeout.exe
612	timeout.exe
2556	timeout.exe
4988	timeout.exe
3056	timeout.exe
1708	timeout.exe
1260	timeout.exe
2984	timeout.exe
2492	timeout.exe
4524	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4668	powershell.exe
4668	powershell.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4156	tasklist.exe
Token: SeDebugPrivilege	3724	tasklist.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	4348	tasklist.exe
Token: SeDebugPrivilege	2456	tasklist.exe
Token: SeDebugPrivilege	3272	tasklist.exe
Token: SeDebugPrivilege	4196	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	5068	tasklist.exe
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	876	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	3580	tasklist.exe
Token: SeDebugPrivilege	3964	tasklist.exe
Token: SeDebugPrivilege	2580	tasklist.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	3480	tasklist.exe
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	5048	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	552	tasklist.exe
Token: SeDebugPrivilege	3512	tasklist.exe
Token: SeDebugPrivilege	4044	tasklist.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	4064	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	4432	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	2384	tasklist.exe
Token: SeDebugPrivilege	1804	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	3184	tasklist.exe
Token: SeDebugPrivilege	2556	tasklist.exe
Token: SeDebugPrivilege	3168	tasklist.exe
Token: SeDebugPrivilege	640	tasklist.exe
Token: SeDebugPrivilege	3504	tasklist.exe
Token: SeDebugPrivilege	2724	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeDebugPrivilege	4800	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	908	tasklist.exe
Token: SeDebugPrivilege	3436	tasklist.exe
Token: SeDebugPrivilege	4772	tasklist.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeDebugPrivilege	1800	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	3468	tasklist.exe
Token: SeDebugPrivilege	1872	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 5116	3052	2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe	86
PID 5116 wrote to memory of 4284	5116	cmd.exe	88
PID 3052 wrote to memory of 2732	3052	2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe	90
PID 4568 wrote to memory of 4360	4568	PeerService.exe	93
PID 4568 wrote to memory of 1200	4568	PeerService.exe	94
PID 2732 wrote to memory of 4084	2732	PeerService.exe	98
PID 2732 wrote to memory of 4420	2732	PeerService.exe	99
PID 4360 wrote to memory of 4668	4360	cmd.exe	102
PID 4084 wrote to memory of 3832	4084	cmd.exe	104
PID 4420 wrote to memory of 4156	4420	cmd.exe	105
PID 4420 wrote to memory of 4192	4420	cmd.exe	106
PID 1200 wrote to memory of 3724	1200	cmd.exe	107
PID 1200 wrote to memory of 3784	1200	cmd.exe	108
PID 4420 wrote to memory of 2292	4420	cmd.exe	109
PID 1200 wrote to memory of 1708	1200	cmd.exe	110
PID 1200 wrote to memory of 4348	1200	cmd.exe	111
PID 1200 wrote to memory of 852	1200	cmd.exe	112
PID 4420 wrote to memory of 2456	4420	cmd.exe	113
PID 4420 wrote to memory of 4960	4420	cmd.exe	114
PID 1200 wrote to memory of 4112	1200	cmd.exe	115
PID 4420 wrote to memory of 3992	4420	cmd.exe	116
PID 1200 wrote to memory of 3272	1200	cmd.exe	118
PID 1200 wrote to memory of 4800	1200	cmd.exe	119
PID 4420 wrote to memory of 4196	4420	cmd.exe	120
PID 4420 wrote to memory of 4652	4420	cmd.exe	121
PID 1200 wrote to memory of 3236	1200	cmd.exe	122
PID 4420 wrote to memory of 2416	4420	cmd.exe	123
PID 1200 wrote to memory of 1124	1200	cmd.exe	128
PID 1200 wrote to memory of 1780	1200	cmd.exe	129
PID 4420 wrote to memory of 5068	4420	cmd.exe	130
PID 4420 wrote to memory of 2912	4420	cmd.exe	131
PID 1200 wrote to memory of 972	1200	cmd.exe	132
PID 4420 wrote to memory of 2076	4420	cmd.exe	133
PID 1200 wrote to memory of 2708	1200	cmd.exe	136
PID 1200 wrote to memory of 4752	1200	cmd.exe	137
PID 4420 wrote to memory of 876	4420	cmd.exe	138
PID 4420 wrote to memory of 4220	4420	cmd.exe	139
PID 1200 wrote to memory of 1332	1200	cmd.exe	140
PID 4420 wrote to memory of 5052	4420	cmd.exe	141
PID 1200 wrote to memory of 2204	1200	cmd.exe	142
PID 1200 wrote to memory of 4276	1200	cmd.exe	143
PID 4420 wrote to memory of 4204	4420	cmd.exe	144
PID 4420 wrote to memory of 1320	4420	cmd.exe	145
PID 1200 wrote to memory of 4964	1200	cmd.exe	146
PID 4420 wrote to memory of 1232	4420	cmd.exe	147
PID 4420 wrote to memory of 3580	4420	cmd.exe	149
PID 4420 wrote to memory of 3496	4420	cmd.exe	150
PID 1200 wrote to memory of 3964	1200	cmd.exe	151
PID 1200 wrote to memory of 2460	1200	cmd.exe	152
PID 4420 wrote to memory of 4988	4420	cmd.exe	153
PID 1200 wrote to memory of 2632	1200	cmd.exe	154
PID 1200 wrote to memory of 2580	1200	cmd.exe	155
PID 1200 wrote to memory of 888	1200	cmd.exe	156
PID 4420 wrote to memory of 2256	4420	cmd.exe	157
PID 4420 wrote to memory of 3968	4420	cmd.exe	158
PID 1200 wrote to memory of 4496	1200	cmd.exe	159
PID 4420 wrote to memory of 408	4420	cmd.exe	160
PID 1200 wrote to memory of 4640	1200	cmd.exe	161
PID 1200 wrote to memory of 4624	1200	cmd.exe	162
PID 4420 wrote to memory of 3480	4420	cmd.exe	163
PID 4420 wrote to memory of 1708	4420	cmd.exe	164
PID 1200 wrote to memory of 1456	1200	cmd.exe	165
PID 4420 wrote to memory of 1704	4420	cmd.exe	166
PID 1200 wrote to memory of 2492	1200	cmd.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4156
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4192
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2456
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4960
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4652
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4204
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3580
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3968
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3480
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5048
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:764
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:552
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4388
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:928
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3580
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4648
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3804
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3608
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1804
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1376
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3168
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3908
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:872
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1956
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3212
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1084
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2556

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1780
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4752
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2632
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2456
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1984
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5000
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5020
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2128
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1704
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2784
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2584
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3204
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3492
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2384
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:612
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2300
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 238B
SHA256 6d1a4a67a30d5c253f5ff88c565ec7fb813acabd0fca654ee62b34c288de2fef
MD5 a3ce26a3db0aae62b03cdbc15b2eccf2
SHA1 f0248ad4f81099dcdfb8a78f49e21fff47951d76
SHA512 833783d03562ddd85ef947d9fbd275e46c464e0af7e5fc4c83a5d6ebdc37f0cde84a3dc01697e48cf4ae9f7a29497face6a40a8c5d792fa57d8b5ae771224787
TLSH
T111D08065F754D510CC91577CD04D5522771989578C43EE267E48D13895E74C4CB712B4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gkstvf02.yqj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gkstvf02.yqj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 9.3MB
SHA256 7ba626c8f37a2e14333b826ed918fef3a8e28301ee1b87e186be447a25072d56
MD5 4e9cbf963e44b41ad7053eb34b5b0892
SHA1 3fb83125edf5a7a1b2b80132113c1ee0bca502d9
SHA512 958f2c80860240488ac3164e2fa9a26ce2aa605d71babbc442db21da2885bb572ce7b9dce354ce5b83b12cc34a6240bba5a31c7e0bb3da3c22bfb760cf99568d
SSDEEP 196608:M+hx9ekEEByQyVG/uzGNVyAl3K8fCG9ByQyVG/uzGNVyAl3K8fCGnbP3JzATI:r9e2NSG/lVrl3KExNSG/lVrl3KExL3Jv
TLSH
T1AFA6126BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4668-22-0x000001F548780000-0x000001F5487A2000-memory.dmp

Download