85da92b7b46228b89b954d1d1378a9335172c6a4e13d5d373f1d2801a6521499

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_cd07476c397a2130315e3a4dbd6242f7_icedid_njrat_stealc.exe
Size 3.8MB
Sample260906-wbpl9axtcs
SHA256 85da92b7b46228b89b954d1d1378a9335172c6a4e13d5d373f1d2801a6521499
MD5 cd07476c397a2130315e3a4dbd6242f7
SHA1 b66c5c7b96fc3a897286ea32595f68f461ea43f2
SHA512 e8ca5fab7739ee251a485715895a0a8bc7ef7e0b4a9619ad4dbcae15dfbd8cafca28fc7e94d1344bd8e8865ccbda8f400ecfb53473a5737cf3e8d600b49dfdce
SSDEEP 98304:C+hxpLJlKkhsRWGoqZ92yVG/uzGNV9Hku:C+hx9ekiMByQyVG/uzGNVyu
TLSH
T10816D02BB26901E8D1BFD17CC9165907EBB2780503A0A7DF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1712	powershell.exe
5964	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4904	PeerService.exe
2744	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4664	tasklist.exe
1104	tasklist.exe
5224	tasklist.exe
2792	tasklist.exe
4508	tasklist.exe
4828	tasklist.exe
6092	tasklist.exe
4676	tasklist.exe
2364	tasklist.exe
2656	tasklist.exe
4244	tasklist.exe
4160	tasklist.exe
5172	tasklist.exe
4720	tasklist.exe
2460	tasklist.exe
4292	tasklist.exe
1992	tasklist.exe
5860	tasklist.exe
2624	tasklist.exe
1536	tasklist.exe
5884	tasklist.exe
5236	tasklist.exe
2140	tasklist.exe
852	tasklist.exe
3328	tasklist.exe
1424	tasklist.exe
4120	tasklist.exe
4328	tasklist.exe
3132	tasklist.exe
5524	tasklist.exe
4940	tasklist.exe
2576	tasklist.exe
1408	tasklist.exe
3136	tasklist.exe
1108	tasklist.exe
5988	tasklist.exe
5964	tasklist.exe
4784	tasklist.exe
2628	tasklist.exe
4496	tasklist.exe
5356	tasklist.exe
4704	tasklist.exe
4644	tasklist.exe
988	tasklist.exe
5696	tasklist.exe
4496	tasklist.exe
2452	tasklist.exe
4412	tasklist.exe
1948	tasklist.exe
2528	tasklist.exe
2872	tasklist.exe
5208	tasklist.exe
4040	tasklist.exe
2860	tasklist.exe
1252	tasklist.exe
1828	tasklist.exe
4960	tasklist.exe
4792	tasklist.exe
3284	tasklist.exe
2632	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
3596	cmd.exe
1888	cmd.exe
2056	cmd.exe
5012	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2980	timeout.exe
4460	timeout.exe
1768	timeout.exe
4148	timeout.exe
3652	timeout.exe
4856	timeout.exe
3448	timeout.exe
884	timeout.exe
1716	timeout.exe
4124	timeout.exe
5928	timeout.exe
2772	timeout.exe
2424	timeout.exe
2780	timeout.exe
6032	timeout.exe
2796	timeout.exe
5092	timeout.exe
3376	timeout.exe
976	timeout.exe
800	timeout.exe
5804	timeout.exe
3316	timeout.exe
2940	timeout.exe
5060	timeout.exe
2072	timeout.exe
3644	timeout.exe
5060	timeout.exe
2484	timeout.exe
2852	timeout.exe
4208	timeout.exe
3356	timeout.exe
4688	timeout.exe
4572	timeout.exe
708	timeout.exe
4980	timeout.exe
5872	timeout.exe
1424	timeout.exe
1120	timeout.exe
2860	timeout.exe
3688	timeout.exe
3428	timeout.exe
2356	timeout.exe
1604	timeout.exe
3928	timeout.exe
1184	timeout.exe
4368	timeout.exe
1180	timeout.exe
5968	timeout.exe
1256	timeout.exe
4124	timeout.exe
5456	timeout.exe
4188	timeout.exe
4784	timeout.exe
5988	timeout.exe
3444	timeout.exe
4528	timeout.exe
2184	timeout.exe
2444	timeout.exe
2916	timeout.exe
1972	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5964	powershell.exe
5964	powershell.exe
1712	powershell.exe
1712	powershell.exe
1712	powershell.exe
5964	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1828	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1712	powershell.exe
Token: SeSecurityPrivilege	1712	powershell.exe
Token: SeTakeOwnershipPrivilege	1712	powershell.exe
Token: SeLoadDriverPrivilege	1712	powershell.exe
Token: SeSystemProfilePrivilege	1712	powershell.exe
Token: SeSystemtimePrivilege	1712	powershell.exe
Token: SeProfSingleProcessPrivilege	1712	powershell.exe
Token: SeIncBasePriorityPrivilege	1712	powershell.exe
Token: SeCreatePagefilePrivilege	1712	powershell.exe
Token: SeBackupPrivilege	1712	powershell.exe
Token: SeRestorePrivilege	1712	powershell.exe
Token: SeShutdownPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeSystemEnvironmentPrivilege	1712	powershell.exe
Token: SeRemoteShutdownPrivilege	1712	powershell.exe
Token: SeUndockPrivilege	1712	powershell.exe
Token: SeManageVolumePrivilege	1712	powershell.exe
Token: 33	1712	powershell.exe
Token: 34	1712	powershell.exe
Token: 35	1712	powershell.exe
Token: 36	1712	powershell.exe
Token: SeIncreaseQuotaPrivilege	5964	powershell.exe
Token: SeSecurityPrivilege	5964	powershell.exe
Token: SeTakeOwnershipPrivilege	5964	powershell.exe
Token: SeLoadDriverPrivilege	5964	powershell.exe
Token: SeSystemProfilePrivilege	5964	powershell.exe
Token: SeSystemtimePrivilege	5964	powershell.exe
Token: SeProfSingleProcessPrivilege	5964	powershell.exe
Token: SeIncBasePriorityPrivilege	5964	powershell.exe
Token: SeCreatePagefilePrivilege	5964	powershell.exe
Token: SeBackupPrivilege	5964	powershell.exe
Token: SeRestorePrivilege	5964	powershell.exe
Token: SeShutdownPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeSystemEnvironmentPrivilege	5964	powershell.exe
Token: SeRemoteShutdownPrivilege	5964	powershell.exe
Token: SeUndockPrivilege	5964	powershell.exe
Token: SeManageVolumePrivilege	5964	powershell.exe
Token: 33	5964	powershell.exe
Token: 34	5964	powershell.exe
Token: 35	5964	powershell.exe
Token: 36	5964	powershell.exe
Token: SeDebugPrivilege	4676	tasklist.exe
Token: SeDebugPrivilege	4960	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeDebugPrivilege	4792	tasklist.exe
Token: SeDebugPrivilege	5356	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	1104	tasklist.exe
Token: SeDebugPrivilege	1408	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe
Token: SeDebugPrivilege	1536	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	2140	tasklist.exe
Token: SeDebugPrivilege	3132	tasklist.exe
Token: SeDebugPrivilege	2628	tasklist.exe
Token: SeDebugPrivilege	988	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 4532	6100	2026-09-06_cd07476c397a2130315e3a4dbd6242f7_icedid_njrat_stealc.exe	90
PID 4532 wrote to memory of 4172	4532	cmd.exe	92
PID 6100 wrote to memory of 4904	6100	2026-09-06_cd07476c397a2130315e3a4dbd6242f7_icedid_njrat_stealc.exe	94
PID 2744 wrote to memory of 1888	2744	PeerService.exe	97
PID 4904 wrote to memory of 3596	4904	PeerService.exe	98
PID 1888 wrote to memory of 5964	1888	cmd.exe	101
PID 3596 wrote to memory of 1712	3596	cmd.exe	102
PID 4904 wrote to memory of 2056	4904	PeerService.exe	103
PID 2744 wrote to memory of 5012	2744	PeerService.exe	104
PID 2056 wrote to memory of 1828	2056	cmd.exe	108
PID 5012 wrote to memory of 2576	5012	cmd.exe	109
PID 5012 wrote to memory of 5172	5012	cmd.exe	110
PID 2056 wrote to memory of 1128	2056	cmd.exe	111
PID 2056 wrote to memory of 4784	2056	cmd.exe	114
PID 5012 wrote to memory of 3652	5012	cmd.exe	115
PID 5012 wrote to memory of 4676	5012	cmd.exe	116
PID 5012 wrote to memory of 3268	5012	cmd.exe	117
PID 2056 wrote to memory of 4960	2056	cmd.exe	118
PID 2056 wrote to memory of 4476	2056	cmd.exe	119
PID 5012 wrote to memory of 4572	5012	cmd.exe	120
PID 2056 wrote to memory of 3356	2056	cmd.exe	121
PID 2056 wrote to memory of 4496	2056	cmd.exe	122
PID 2056 wrote to memory of 4196	2056	cmd.exe	123
PID 5012 wrote to memory of 5524	5012	cmd.exe	124
PID 5012 wrote to memory of 4688	5012	cmd.exe	125
PID 2056 wrote to memory of 2772	2056	cmd.exe	126
PID 5012 wrote to memory of 5988	5012	cmd.exe	127
PID 5012 wrote to memory of 4644	5012	cmd.exe	128
PID 5012 wrote to memory of 480	5012	cmd.exe	129
PID 2056 wrote to memory of 4792	2056	cmd.exe	130
PID 2056 wrote to memory of 1088	2056	cmd.exe	131
PID 5012 wrote to memory of 3444	5012	cmd.exe	132
PID 2056 wrote to memory of 2980	2056	cmd.exe	133
PID 5012 wrote to memory of 5356	5012	cmd.exe	134
PID 5012 wrote to memory of 3380	5012	cmd.exe	135
PID 2056 wrote to memory of 2460	2056	cmd.exe	136
PID 2056 wrote to memory of 1636	2056	cmd.exe	137
PID 5012 wrote to memory of 1716	5012	cmd.exe	138
PID 2056 wrote to memory of 4856	2056	cmd.exe	139
PID 5012 wrote to memory of 1104	5012	cmd.exe	140
PID 5012 wrote to memory of 2300	5012	cmd.exe	141
PID 2056 wrote to memory of 1408	2056	cmd.exe	142
PID 2056 wrote to memory of 2660	2056	cmd.exe	143
PID 5012 wrote to memory of 5872	5012	cmd.exe	144
PID 2056 wrote to memory of 800	2056	cmd.exe	145
PID 5012 wrote to memory of 2632	5012	cmd.exe	146
PID 5012 wrote to memory of 1972	5012	cmd.exe	147
PID 2056 wrote to memory of 1536	2056	cmd.exe	148
PID 2056 wrote to memory of 5068	2056	cmd.exe	149
PID 5012 wrote to memory of 5968	5012	cmd.exe	150
PID 2056 wrote to memory of 4460	2056	cmd.exe	151
PID 2056 wrote to memory of 4704	2056	cmd.exe	152
PID 2056 wrote to memory of 4468	2056	cmd.exe	153
PID 5012 wrote to memory of 4664	5012	cmd.exe	154
PID 5012 wrote to memory of 5236	5012	cmd.exe	155
PID 2056 wrote to memory of 1424	2056	cmd.exe	156
PID 5012 wrote to memory of 5060	5012	cmd.exe	157
PID 2056 wrote to memory of 2140	2056	cmd.exe	158
PID 2056 wrote to memory of 4180	2056	cmd.exe	159
PID 5012 wrote to memory of 3132	5012	cmd.exe	160
PID 5012 wrote to memory of 1272	5012	cmd.exe	161
PID 2056 wrote to memory of 1256	2056	cmd.exe	162
PID 5012 wrote to memory of 4528	5012	cmd.exe	163
PID 2056 wrote to memory of 2628	2056	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-06_cd07476c397a2130315e3a4dbd6242f7_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_cd07476c397a2130315e3a4dbd6242f7_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1128
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4792
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1636
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4704
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4576
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3136
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4924
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5352
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4292
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3300
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4160
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5236
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4788
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3284
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3328
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4268
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1768
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6092
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5208
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4312
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2656
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2620
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3376
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4412
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1180

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4688
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1716
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2300
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5968
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4528
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1832
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3688
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5696
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4688
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4244
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2860
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3444
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3428
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5224
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5024
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5884
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2936
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:852
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2796
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1108
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2872
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2792
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4508
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4124
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5860
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5964
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5548
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2804
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:976
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2624
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2580
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nvnxyqfo.bqw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvnxyqfo.bqw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 3.9MB
SHA256 9b453f441869d4cb99de0e490a8b48bb479c448999f73eae039c0e5836bc4d27
MD5 b957fa85b76ac6508173f403feb7221b
SHA1 cef277e3f5f9b22ed223bd0d710c049fd7b70b69
SHA512 dcb2348c668f9ca3a696045a54fd0bd4d54a51fe86ab317008fbb123fba55edba0bd470a3fe32bbf5f23b195b548e08217c96001ad746a00f5929d5511bf632c
SSDEEP 98304:C+hxpLJlKkhsbWGoqZ92yVG/uzGNV9Hkv:C+hx9ekiyByQyVG/uzGNVyv
TLSH
T1BE16D02BB26901E8D1BFD17CC9165907EBB2780543A0A7DF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-20-0x0000010D73DD0000-0x0000010D73E82000-memory.dmp

Download

memory/1712-19-0x0000010D73DB0000-0x0000010D73DCE000-memory.dmp

Download

memory/1712-23-0x0000010D73BA0000-0x0000010D73BAA000-memory.dmp

Download

memory/1712-25-0x0000010D740E0000-0x0000010D741D0000-memory.dmp

Download

memory/5964-14-0x0000020EF84D0000-0x0000020EF84F2000-memory.dmp

Download

memory/5964-28-0x0000020EF8690000-0x0000020EF8780000-memory.dmp

Download