436fcb72247b82088936d12884403318cef4824b85ca976447065863c1b3b751

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe
Size 5.0MB
Sample260905-jbvr2sce92
SHA256 436fcb72247b82088936d12884403318cef4824b85ca976447065863c1b3b751
MD5 6e5bfca9c44a84110846c42c1333d794
SHA1 f7a7bbeeb5a9d4b2f34d0f8fe52a6e3b34e69113
SHA512 0a53f8f9919c6b69156b0476e4aeebe6641ce168bb2ed4e636efd02ee8745a8163217371689079ef17a0b75a1854ae3e7a94e33304250e864a6f29baa6932d2b
SSDEEP 98304:M+hxpLJlKkvs5WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQh:M+hx9ekEEByQyVG/uzGNVyAl3K8fCGh
TLSH
T11536F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2268	powershell.exe
4456	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2800	PeerService.exe
5048	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4444	tasklist.exe
2436	tasklist.exe
4380	tasklist.exe
3456	tasklist.exe
5604	tasklist.exe
4624	tasklist.exe
1996	tasklist.exe
4644	tasklist.exe
1504	tasklist.exe
2136	tasklist.exe
4840	tasklist.exe
5204	tasklist.exe
1012	tasklist.exe
5720	tasklist.exe
4352	tasklist.exe
4812	tasklist.exe
1912	tasklist.exe
1364	tasklist.exe
4924	tasklist.exe
1448	tasklist.exe
4972	tasklist.exe
2500	tasklist.exe
2088	tasklist.exe
4200	tasklist.exe
4732	tasklist.exe
3816	tasklist.exe
2480	tasklist.exe
2096	tasklist.exe
3056	tasklist.exe
3216	tasklist.exe
5020	tasklist.exe
2956	tasklist.exe
2872	tasklist.exe
3756	tasklist.exe
3312	tasklist.exe
1528	tasklist.exe
4816	tasklist.exe
976	tasklist.exe
5204	tasklist.exe
5116	tasklist.exe
1388	tasklist.exe
5784	tasklist.exe
3288	tasklist.exe
4624	tasklist.exe
5868	tasklist.exe
4840	tasklist.exe
4240	tasklist.exe
4576	tasklist.exe
5628	tasklist.exe
1920	tasklist.exe
4648	tasklist.exe
4320	tasklist.exe
4896	tasklist.exe
1344	tasklist.exe
4660	tasklist.exe
4824	tasklist.exe
5100	tasklist.exe
2760	tasklist.exe
1516	tasklist.exe
3720	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1356	cmd.exe
6000	cmd.exe
4684	cmd.exe
4712	cmd.exe
2580	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
5888	timeout.exe
3740	timeout.exe
5460	timeout.exe
5100	timeout.exe
2536	timeout.exe
1176	timeout.exe
2856	timeout.exe
6020	timeout.exe
852	timeout.exe
464	timeout.exe
2164	timeout.exe
4304	timeout.exe
5328	timeout.exe
2324	timeout.exe
2660	timeout.exe
4572	timeout.exe
1452	timeout.exe
5460	timeout.exe
2488	timeout.exe
1984	timeout.exe
4280	timeout.exe
1572	timeout.exe
248	timeout.exe
3484	timeout.exe
2720	timeout.exe
4836	timeout.exe
1288	timeout.exe
1640	timeout.exe
3312	timeout.exe
852	timeout.exe
4320	timeout.exe
1836	timeout.exe
1992	timeout.exe
5016	timeout.exe
2456	timeout.exe
4872	timeout.exe
824	timeout.exe
1376	timeout.exe
5604	timeout.exe
5704	timeout.exe
1816	timeout.exe
2348	timeout.exe
976	timeout.exe
3096	timeout.exe
3904	timeout.exe
6020	timeout.exe
2792	timeout.exe
552	timeout.exe
4400	timeout.exe
4640	timeout.exe
260	timeout.exe
1048	timeout.exe
1316	timeout.exe
2248	timeout.exe
3760	timeout.exe
2616	timeout.exe
2268	timeout.exe
2344	timeout.exe
2952	timeout.exe
2288	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4660	tasklist.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	3056	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4456	powershell.exe
Token: SeSecurityPrivilege	4456	powershell.exe
Token: SeTakeOwnershipPrivilege	4456	powershell.exe
Token: SeLoadDriverPrivilege	4456	powershell.exe
Token: SeSystemProfilePrivilege	4456	powershell.exe
Token: SeSystemtimePrivilege	4456	powershell.exe
Token: SeProfSingleProcessPrivilege	4456	powershell.exe
Token: SeIncBasePriorityPrivilege	4456	powershell.exe
Token: SeCreatePagefilePrivilege	4456	powershell.exe
Token: SeBackupPrivilege	4456	powershell.exe
Token: SeRestorePrivilege	4456	powershell.exe
Token: SeShutdownPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeSystemEnvironmentPrivilege	4456	powershell.exe
Token: SeRemoteShutdownPrivilege	4456	powershell.exe
Token: SeUndockPrivilege	4456	powershell.exe
Token: SeManageVolumePrivilege	4456	powershell.exe
Token: 33	4456	powershell.exe
Token: 34	4456	powershell.exe
Token: 35	4456	powershell.exe
Token: 36	4456	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	powershell.exe
Token: SeSecurityPrivilege	2268	powershell.exe
Token: SeTakeOwnershipPrivilege	2268	powershell.exe
Token: SeLoadDriverPrivilege	2268	powershell.exe
Token: SeSystemProfilePrivilege	2268	powershell.exe
Token: SeSystemtimePrivilege	2268	powershell.exe
Token: SeProfSingleProcessPrivilege	2268	powershell.exe
Token: SeIncBasePriorityPrivilege	2268	powershell.exe
Token: SeCreatePagefilePrivilege	2268	powershell.exe
Token: SeBackupPrivilege	2268	powershell.exe
Token: SeRestorePrivilege	2268	powershell.exe
Token: SeShutdownPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeSystemEnvironmentPrivilege	2268	powershell.exe
Token: SeRemoteShutdownPrivilege	2268	powershell.exe
Token: SeUndockPrivilege	2268	powershell.exe
Token: SeManageVolumePrivilege	2268	powershell.exe
Token: 33	2268	powershell.exe
Token: 34	2268	powershell.exe
Token: 35	2268	powershell.exe
Token: 36	2268	powershell.exe
Token: SeDebugPrivilege	1912	tasklist.exe
Token: SeDebugPrivilege	3756	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	1516	tasklist.exe
Token: SeDebugPrivilege	4924	tasklist.exe
Token: SeDebugPrivilege	1364	tasklist.exe
Token: SeDebugPrivilege	4320	tasklist.exe
Token: SeDebugPrivilege	5204	tasklist.exe
Token: SeDebugPrivilege	4732	tasklist.exe
Token: SeDebugPrivilege	2500	tasklist.exe
Token: SeDebugPrivilege	4380	tasklist.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeDebugPrivilege	5604	tasklist.exe
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeDebugPrivilege	3312	tasklist.exe
Token: SeDebugPrivilege	2088	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2580	3364	2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe	90
PID 2580 wrote to memory of 3080	2580	cmd.exe	92
PID 3364 wrote to memory of 5048	3364	2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe	95
PID 2800 wrote to memory of 1356	2800	PeerService.exe	96
PID 2800 wrote to memory of 6000	2800	PeerService.exe	97
PID 1356 wrote to memory of 4456	1356	cmd.exe	102
PID 6000 wrote to memory of 4660	6000	cmd.exe	103
PID 6000 wrote to memory of 364	6000	cmd.exe	104
PID 5048 wrote to memory of 4684	5048	PeerService.exe	105
PID 5048 wrote to memory of 4712	5048	PeerService.exe	106
PID 4684 wrote to memory of 2268	4684	cmd.exe	109
PID 4712 wrote to memory of 3056	4712	cmd.exe	111
PID 4712 wrote to memory of 5628	4712	cmd.exe	112
PID 4712 wrote to memory of 4640	4712	cmd.exe	114
PID 6000 wrote to memory of 5016	6000	cmd.exe	115
PID 4712 wrote to memory of 1912	4712	cmd.exe	116
PID 4712 wrote to memory of 1148	4712	cmd.exe	117
PID 6000 wrote to memory of 3756	6000	cmd.exe	118
PID 6000 wrote to memory of 4852	6000	cmd.exe	119
PID 6000 wrote to memory of 3760	6000	cmd.exe	120
PID 4712 wrote to memory of 1984	4712	cmd.exe	121
PID 6000 wrote to memory of 2760	6000	cmd.exe	122
PID 6000 wrote to memory of 2020	6000	cmd.exe	123
PID 4712 wrote to memory of 1516	4712	cmd.exe	124
PID 4712 wrote to memory of 5868	4712	cmd.exe	125
PID 6000 wrote to memory of 4280	6000	cmd.exe	126
PID 4712 wrote to memory of 2792	4712	cmd.exe	127
PID 4712 wrote to memory of 1364	4712	cmd.exe	128
PID 6000 wrote to memory of 4924	6000	cmd.exe	129
PID 4712 wrote to memory of 1076	4712	cmd.exe	130
PID 6000 wrote to memory of 4292	6000	cmd.exe	131
PID 6000 wrote to memory of 6020	6000	cmd.exe	132
PID 4712 wrote to memory of 3740	4712	cmd.exe	133
PID 6000 wrote to memory of 4320	6000	cmd.exe	134
PID 6000 wrote to memory of 3828	6000	cmd.exe	135
PID 4712 wrote to memory of 5204	4712	cmd.exe	136
PID 4712 wrote to memory of 2264	4712	cmd.exe	137
PID 6000 wrote to memory of 5460	6000	cmd.exe	138
PID 4712 wrote to memory of 2456	4712	cmd.exe	139
PID 4712 wrote to memory of 4732	4712	cmd.exe	140
PID 4712 wrote to memory of 5864	4712	cmd.exe	141
PID 6000 wrote to memory of 2500	6000	cmd.exe	142
PID 6000 wrote to memory of 5156	6000	cmd.exe	143
PID 4712 wrote to memory of 4872	4712	cmd.exe	144
PID 6000 wrote to memory of 1572	6000	cmd.exe	145
PID 4712 wrote to memory of 4380	4712	cmd.exe	146
PID 4712 wrote to memory of 3464	4712	cmd.exe	147
PID 6000 wrote to memory of 3456	6000	cmd.exe	148
PID 6000 wrote to memory of 4364	6000	cmd.exe	149
PID 4712 wrote to memory of 2616	4712	cmd.exe	150
PID 6000 wrote to memory of 5100	6000	cmd.exe	151
PID 4712 wrote to memory of 4896	4712	cmd.exe	152
PID 4712 wrote to memory of 4304	4712	cmd.exe	153
PID 6000 wrote to memory of 1448	6000	cmd.exe	154
PID 6000 wrote to memory of 1812	6000	cmd.exe	155
PID 4712 wrote to memory of 2660	4712	cmd.exe	156
PID 6000 wrote to memory of 2348	6000	cmd.exe	157
PID 4712 wrote to memory of 5604	4712	cmd.exe	158
PID 4712 wrote to memory of 5964	4712	cmd.exe	159
PID 6000 wrote to memory of 4624	6000	cmd.exe	160
PID 6000 wrote to memory of 3660	6000	cmd.exe	161
PID 4712 wrote to memory of 248	4712	cmd.exe	162
PID 6000 wrote to memory of 552	6000	cmd.exe	163
PID 6000 wrote to memory of 3312	6000	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_6e5bfca9c44a84110846c42c1333d794_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3080
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1148
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5204
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2264
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4380
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3464
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4896
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5604
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2088
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3216
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3000
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1344
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4832
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4136
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5020
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5672
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4624
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4724
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1176
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5868
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4352
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4308
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4200
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2436
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3976
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1012
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1992

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2020
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4280
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4292
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6020
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3828
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5460
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1812
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2348
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:552
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5780
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1892
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1504
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2960
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1376
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2956
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5096
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4840
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5100
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4304
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2404
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5604
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4620
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2268
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2480
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:768
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1316
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1832
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2248
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2792
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1528
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4812
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1264
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4840
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mnhpngpx.cye.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mnhpngpx.cye.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.3MB
SHA256 0e47643fd3650c4f3d028fb572803b4cf2eb15512e7b6f47c75b6ae25da2db51
MD5 5a54ec513b6539522e12339339fdeded
SHA1 36cff30096f1bfa872431d40fddc19d34b4da3b7
SHA512 f9a4640b0e4d0dfb71cbff850875aa18425c1d6233c0193252bdeb16bd645c71c72358239bd4c0b0cb64e02bf34563342bab46c2663edb8268972fb2e677deda
SSDEEP 196608:M+hx9ekEQByQyVG/uzGNVyAl3K8fCGnbP3JzAb:r9eiNSG/lVrl3KExL3JzAb
TLSH
T18C66012BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4456-14-0x0000025959D40000-0x0000025959D62000-memory.dmp

Download

memory/4456-19-0x0000025971F60000-0x0000025971F7E000-memory.dmp

Download

memory/4456-20-0x0000025972200000-0x00000259722B2000-memory.dmp

Download

memory/4456-21-0x0000025971F80000-0x0000025971F8A000-memory.dmp

Download