0da0659f4b14982f3e88fde5ab2789581c9aaf2602053b42cb3fcd42ed75c96d

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe
Size 4.1MB
Sample260910-d2hbraem31
SHA256 0da0659f4b14982f3e88fde5ab2789581c9aaf2602053b42cb3fcd42ed75c96d
MD5 ad94d8945b5c61a7666bdee9a1d52914
SHA1 f853fd6d9eb327d29ba256c4c26f123fa05b8f0f
SHA512 60ca87047d56e6aa7f66ed78aae5922da27f923a7490d83d22720975a228325ae625da7680c8ced3b9ae39e5bd635d649aa63c5a375ce1e15719e3f77f91ae31
SSDEEP 98304:s+hxpLJlKkhskWGoqZ92yVG/uzGNV9HkAn:s+hx9ekiDByQyVG/uzGNVyAn
TLSH
T18816D02BB26901E8D1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2312	powershell.exe
4624	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
4260	PeerService.exe
2148	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5032	tasklist.exe
2636	tasklist.exe
3540	tasklist.exe
4320	tasklist.exe
4376	tasklist.exe
1416	tasklist.exe
2484	tasklist.exe
2504	tasklist.exe
2752	tasklist.exe
432	tasklist.exe
2456	tasklist.exe
2304	tasklist.exe
1416	tasklist.exe
5060	tasklist.exe
736	tasklist.exe
4280	tasklist.exe
4408	tasklist.exe
3384	tasklist.exe
1624	tasklist.exe
4732	tasklist.exe
1496	tasklist.exe
1844	tasklist.exe
3528	tasklist.exe
4376	tasklist.exe
2360	tasklist.exe
2196	tasklist.exe
3300	tasklist.exe
2940	tasklist.exe
4708	tasklist.exe
3968	tasklist.exe
1576	tasklist.exe
2404	tasklist.exe
1364	tasklist.exe
4908	tasklist.exe
432	tasklist.exe
1064	tasklist.exe
1168	tasklist.exe
996	tasklist.exe
1040	tasklist.exe
4952	tasklist.exe
4372	tasklist.exe
4716	tasklist.exe
2404	tasklist.exe
316	tasklist.exe
2512	tasklist.exe
4652	tasklist.exe
416	tasklist.exe
3300	tasklist.exe
1432	tasklist.exe
2204	tasklist.exe
4504	tasklist.exe
3208	tasklist.exe
4384	tasklist.exe
3032	tasklist.exe
2156	tasklist.exe
1952	tasklist.exe
4708	tasklist.exe
4760	tasklist.exe
2524	tasklist.exe
824	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5008	cmd.exe
372	cmd.exe
1580	cmd.exe
2556	cmd.exe
3416	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
4164	timeout.exe
3856	timeout.exe
2276	timeout.exe
3832	timeout.exe
5080	timeout.exe
1432	timeout.exe
4756	timeout.exe
1844	timeout.exe
3536	timeout.exe
2676	timeout.exe
5020	timeout.exe
3584	timeout.exe
2840	timeout.exe
3032	timeout.exe
3032	timeout.exe
4956	timeout.exe
3316	timeout.exe
824	timeout.exe
972	timeout.exe
4976	timeout.exe
972	timeout.exe
2888	timeout.exe
3840	timeout.exe
936	timeout.exe
1772	timeout.exe
1392	timeout.exe
5044	timeout.exe
1960	timeout.exe
4332	timeout.exe
4664	timeout.exe
4716	timeout.exe
3108	timeout.exe
3260	timeout.exe
3068	timeout.exe
4276	timeout.exe
3948	timeout.exe
3524	timeout.exe
1848	timeout.exe
4780	timeout.exe
1120	timeout.exe
2312	timeout.exe
2964	timeout.exe
5024	timeout.exe
4092	timeout.exe
4576	timeout.exe
4316	timeout.exe
4060	timeout.exe
4620	timeout.exe
3568	timeout.exe
216	timeout.exe
2360	timeout.exe
3288	timeout.exe
4904	timeout.exe
1404	timeout.exe
3592	timeout.exe
1040	timeout.exe
1756	timeout.exe
3224	timeout.exe
4660	timeout.exe
3544	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2312	powershell.exe
4624	powershell.exe
4624	powershell.exe
2312	powershell.exe
2312	powershell.exe
4624	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	tasklist.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	1168	tasklist.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	3300	tasklist.exe
Token: SeDebugPrivilege	4376	tasklist.exe
Token: SeDebugPrivilege	1432	tasklist.exe
Token: SeDebugPrivilege	432	tasklist.exe
Token: SeDebugPrivilege	1576	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	4760	tasklist.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeDebugPrivilege	2456	tasklist.exe
Token: SeDebugPrivilege	316	tasklist.exe
Token: SeDebugPrivilege	996	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	4408	tasklist.exe
Token: SeDebugPrivilege	3384	tasklist.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeDebugPrivilege	3300	tasklist.exe
Token: SeDebugPrivilege	3540	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	432	tasklist.exe
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	2484	tasklist.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	416	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	2304	tasklist.exe
Token: SeDebugPrivilege	824	tasklist.exe
Token: SeDebugPrivilege	1064	tasklist.exe
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeDebugPrivilege	4908	tasklist.exe
Token: SeDebugPrivilege	4504	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	3208	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeDebugPrivilege	2156	tasklist.exe
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	3968	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	1624	tasklist.exe
Token: SeDebugPrivilege	4732	tasklist.exe
Token: SeDebugPrivilege	1952	tasklist.exe
Token: SeDebugPrivilege	1844	tasklist.exe
Token: SeDebugPrivilege	1496	tasklist.exe
Token: SeDebugPrivilege	3528	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	4372	tasklist.exe
Token: SeDebugPrivilege	4376	tasklist.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	4320	tasklist.exe
Token: SeDebugPrivilege	736	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 5008	4600	2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe	86
PID 5008 wrote to memory of 3904	5008	cmd.exe	88
PID 4600 wrote to memory of 4260	4600	2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe	89
PID 4260 wrote to memory of 372	4260	PeerService.exe	92
PID 4260 wrote to memory of 1580	4260	PeerService.exe	94
PID 1580 wrote to memory of 1364	1580	cmd.exe	97
PID 1580 wrote to memory of 4564	1580	cmd.exe	98
PID 372 wrote to memory of 2312	372	cmd.exe	99
PID 2148 wrote to memory of 3416	2148	PeerService.exe	102
PID 2148 wrote to memory of 2556	2148	PeerService.exe	103
PID 3416 wrote to memory of 4624	3416	cmd.exe	106
PID 2556 wrote to memory of 1168	2556	cmd.exe	107
PID 2556 wrote to memory of 3704	2556	cmd.exe	108
PID 2556 wrote to memory of 3592	2556	cmd.exe	109
PID 1580 wrote to memory of 1772	1580	cmd.exe	110
PID 2556 wrote to memory of 2360	2556	cmd.exe	113
PID 2556 wrote to memory of 732	2556	cmd.exe	114
PID 1580 wrote to memory of 3300	1580	cmd.exe	116
PID 1580 wrote to memory of 3492	1580	cmd.exe	117
PID 2556 wrote to memory of 4956	2556	cmd.exe	118
PID 1580 wrote to memory of 2276	1580	cmd.exe	119
PID 2556 wrote to memory of 4376	2556	cmd.exe	121
PID 2556 wrote to memory of 3716	2556	cmd.exe	122
PID 1580 wrote to memory of 1432	1580	cmd.exe	123
PID 1580 wrote to memory of 2204	1580	cmd.exe	124
PID 1580 wrote to memory of 3032	1580	cmd.exe	125
PID 2556 wrote to memory of 5044	2556	cmd.exe	126
PID 1580 wrote to memory of 1576	1580	cmd.exe	130
PID 2556 wrote to memory of 432	2556	cmd.exe	129
PID 1580 wrote to memory of 2904	1580	cmd.exe	131
PID 2556 wrote to memory of 2520	2556	cmd.exe	132
PID 1580 wrote to memory of 4620	1580	cmd.exe	133
PID 2556 wrote to memory of 3260	2556	cmd.exe	134
PID 1580 wrote to memory of 4708	1580	cmd.exe	135
PID 1580 wrote to memory of 1448	1580	cmd.exe	136
PID 2556 wrote to memory of 4760	2556	cmd.exe	137
PID 2556 wrote to memory of 4296	2556	cmd.exe	138
PID 1580 wrote to memory of 3568	1580	cmd.exe	139
PID 2556 wrote to memory of 1040	2556	cmd.exe	140
PID 1580 wrote to memory of 4716	1580	cmd.exe	141
PID 2556 wrote to memory of 2456	2556	cmd.exe	142
PID 2556 wrote to memory of 1880	2556	cmd.exe	143
PID 1580 wrote to memory of 2660	1580	cmd.exe	144
PID 1580 wrote to memory of 1960	1580	cmd.exe	145
PID 2556 wrote to memory of 972	2556	cmd.exe	146
PID 1580 wrote to memory of 316	1580	cmd.exe	148
PID 1580 wrote to memory of 4796	1580	cmd.exe	149
PID 2556 wrote to memory of 996	2556	cmd.exe	150
PID 2556 wrote to memory of 3188	2556	cmd.exe	151
PID 1580 wrote to memory of 3524	1580	cmd.exe	152
PID 2556 wrote to memory of 2312	2556	cmd.exe	153
PID 1580 wrote to memory of 2196	1580	cmd.exe	154
PID 1580 wrote to memory of 1364	1580	cmd.exe	155
PID 2556 wrote to memory of 4408	2556	cmd.exe	156
PID 2556 wrote to memory of 4524	2556	cmd.exe	157
PID 1580 wrote to memory of 3840	1580	cmd.exe	158
PID 2556 wrote to memory of 1844	2556	cmd.exe	159
PID 2556 wrote to memory of 3384	2556	cmd.exe	160
PID 2556 wrote to memory of 3016	2556	cmd.exe	161
PID 1580 wrote to memory of 1416	1580	cmd.exe	162
PID 1580 wrote to memory of 4196	1580	cmd.exe	163
PID 2556 wrote to memory of 1756	2556	cmd.exe	164
PID 1580 wrote to memory of 3316	1580	cmd.exe	165
PID 1580 wrote to memory of 3300	1580	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3904
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2312
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3300
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4708
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4716
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1364
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3300
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3880
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4652
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1064
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2504
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4908
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2668
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3208
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2636
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2752
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3968
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2108
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1624
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2888
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4928
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3296
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4376
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4320
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4756

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3704
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4956
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5044
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4296
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1040
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4524
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3016
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2500
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4976
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5020
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:724
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3068
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4196
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3584
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2676
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3544
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:796
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5020
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3920
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1720
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2924
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3720
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1432
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:736
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3048
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e2d1f92a7985c38161bb08726c708271673b6644d66b327b72e5023a53daf2c
MD5 0b9ebff96ce87bb2948f7decf425a335
SHA1 3172582f4a97c15d0c5162c547fe81b811de8e74
SHA512 4eeaf75114389ca025b6eb589c160f03ddceb2e2c67196f05cdf2da5c946c617816056265a0420dcae13c19781a291ef8c456cd08bca6760bbcdd89a83e96357
TLSH
T1F7112267F78C8960CC96163A509DAC5172B586CB91AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u54czyb5.f4c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u54czyb5.f4c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.1MB
SHA256 3820faa4428ec9b52b93a380f25faee8f247c619dfebd38fbb71f4c33975ef8e
MD5 ca86ee460e1f023d8309ddeafd3781a1
SHA1 3ec1102ff0c27a938f13919218ae6f5c4c9d2165
SHA512 6b590b9087c0948c56b39bce97c3bcb322fa890748737fd5669711afb02ff81f9ea2ed96021db14dabe63e04d53b06a1037e82f00a96bca295b9947b4609cdcc
SSDEEP 196608:s+hx9ekiDByQyVG/uzGNVyAvByQyVG/uzGNVyA+:L9eZNSG/lVr5NSG/lVr+
TLSH
T12356F16BB26901E8D1BBD17CC9065907EBB2780543A0A7DF12E046A62F73BE14F7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2312-27-0x00000280FDD30000-0x00000280FDD52000-memory.dmp

Download