3b0bf24dd1bfb31545c94fba553fff9b2e52a9450e0edb9fe72d5dcff0c6cc15

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_295bd5140c2570b1c24d667d585f3728_icedid_njrat_stealc.exe
Size 6.1MB
Sample260912-n8frlsbc37
SHA256 3b0bf24dd1bfb31545c94fba553fff9b2e52a9450e0edb9fe72d5dcff0c6cc15
MD5 295bd5140c2570b1c24d667d585f3728
SHA1 54cda0d7cd37c53c06bb9717818c2da8c0d684a5
SHA512 d854dd3037c947315c0a6d37f8cfb35079e1fe18a7a3343ab3c3c21ba361e93145a30643731152be6a3371ea337e94d2083af246a6a3e330a81d64ddeeb47338
SSDEEP 196608:++hx9ekhByQyVG/uzGNVyAl3K8fCGnbP3Jf:h9eENSG/lVrl3KExL3Jf
TLSH
T1F656F16B726901E8E1BFD17CC9065907EBB2780543A0A7DF12E046A62F77BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe
2160	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-09-11_295bd5140c2570b1c24d667d585f3728_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
4984	PeerService.exe
4724	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4144	tasklist.exe
2416	tasklist.exe
4620	tasklist.exe
4816	tasklist.exe
4440	tasklist.exe
1876	tasklist.exe
3692	tasklist.exe
2376	tasklist.exe
4836	tasklist.exe
448	tasklist.exe
732	tasklist.exe
3900	tasklist.exe
2612	tasklist.exe
3852	tasklist.exe
1516	tasklist.exe
3592	tasklist.exe
4928	tasklist.exe
4252	tasklist.exe
3492	tasklist.exe
5044	tasklist.exe
616	tasklist.exe
2836	tasklist.exe
1420	tasklist.exe
2576	tasklist.exe
1768	tasklist.exe
808	tasklist.exe
3236	tasklist.exe
1304	tasklist.exe
3432	tasklist.exe
976	tasklist.exe
3768	tasklist.exe
2720	tasklist.exe
1516	tasklist.exe
3576	tasklist.exe
3104	tasklist.exe
760	tasklist.exe
4420	tasklist.exe
4180	tasklist.exe
3460	tasklist.exe
4592	tasklist.exe
4168	tasklist.exe
3592	tasklist.exe
3632	tasklist.exe
224	tasklist.exe
4464	tasklist.exe
3116	tasklist.exe
3432	tasklist.exe
2680	tasklist.exe
3632	tasklist.exe
3152	tasklist.exe
3520	tasklist.exe
992	tasklist.exe
1900	tasklist.exe
4664	tasklist.exe
4964	tasklist.exe
4236	tasklist.exe
464	tasklist.exe
924	tasklist.exe
4816	tasklist.exe
1188	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5060	cmd.exe
624	cmd.exe
4848	cmd.exe
2820	cmd.exe
4924	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2960	timeout.exe
4780	timeout.exe
2596	timeout.exe
1500	timeout.exe
3196	timeout.exe
740	timeout.exe
1056	timeout.exe
2520	timeout.exe
3064	timeout.exe
4888	timeout.exe
828	timeout.exe
2692	timeout.exe
4500	timeout.exe
4792	timeout.exe
3324	timeout.exe
4236	timeout.exe
4080	timeout.exe
2332	timeout.exe
1820	timeout.exe
4492	timeout.exe
4380	timeout.exe
888	timeout.exe
4484	timeout.exe
1056	timeout.exe
464	timeout.exe
4932	timeout.exe
1636	timeout.exe
1116	timeout.exe
4160	timeout.exe
4360	timeout.exe
4180	timeout.exe
2900	timeout.exe
1352	timeout.exe
2368	timeout.exe
3680	timeout.exe
4936	timeout.exe
8	timeout.exe
708	timeout.exe
2268	timeout.exe
5044	timeout.exe
2300	timeout.exe
3152	timeout.exe
4304	timeout.exe
4048	timeout.exe
1148	timeout.exe
2720	timeout.exe
1704	timeout.exe
4416	timeout.exe
5064	timeout.exe
4260	timeout.exe
4936	timeout.exe
772	timeout.exe
4148	timeout.exe
4884	timeout.exe
4412	timeout.exe
1724	timeout.exe
376	timeout.exe
4388	timeout.exe
4744	timeout.exe
5064	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1820	powershell.exe
1820	powershell.exe
2160	powershell.exe
2160	powershell.exe
1820	powershell.exe
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	tasklist.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1516	tasklist.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	732	tasklist.exe
Token: SeDebugPrivilege	3520	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	3492	tasklist.exe
Token: SeDebugPrivilege	2376	tasklist.exe
Token: SeDebugPrivilege	3116	tasklist.exe
Token: SeDebugPrivilege	1420	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	3576	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	4144	tasklist.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	3460	tasklist.exe
Token: SeDebugPrivilege	5044	tasklist.exe
Token: SeDebugPrivilege	1516	tasklist.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	992	tasklist.exe
Token: SeDebugPrivilege	4836	tasklist.exe
Token: SeDebugPrivilege	448	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	3592	tasklist.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	1768	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	4816	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	924	tasklist.exe
Token: SeDebugPrivilege	4928	tasklist.exe
Token: SeDebugPrivilege	3768	tasklist.exe
Token: SeDebugPrivilege	616	tasklist.exe
Token: SeDebugPrivilege	4440	tasklist.exe
Token: SeDebugPrivilege	4236	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	3852	tasklist.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	2680	tasklist.exe
Token: SeDebugPrivilege	4168	tasklist.exe
Token: SeDebugPrivilege	3592	tasklist.exe
Token: SeDebugPrivilege	4180	tasklist.exe
Token: SeDebugPrivilege	2720	tasklist.exe
Token: SeDebugPrivilege	4816	tasklist.exe
Token: SeDebugPrivilege	464	tasklist.exe
Token: SeDebugPrivilege	224	tasklist.exe
Token: SeDebugPrivilege	1876	tasklist.exe
Token: SeDebugPrivilege	4252	tasklist.exe
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	3152	tasklist.exe
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	4464	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 5060	3476	2026-09-11_295bd5140c2570b1c24d667d585f3728_icedid_njrat_stealc.exe	88
PID 5060 wrote to memory of 4132	5060	cmd.exe	90
PID 3476 wrote to memory of 4984	3476	2026-09-11_295bd5140c2570b1c24d667d585f3728_icedid_njrat_stealc.exe	93
PID 4984 wrote to memory of 4848	4984	PeerService.exe	96
PID 4984 wrote to memory of 624	4984	PeerService.exe	97
PID 4724 wrote to memory of 4924	4724	PeerService.exe	102
PID 4724 wrote to memory of 2820	4724	PeerService.exe	103
PID 4848 wrote to memory of 1820	4848	cmd.exe	105
PID 624 wrote to memory of 3692	624	cmd.exe	106
PID 624 wrote to memory of 1988	624	cmd.exe	108
PID 4924 wrote to memory of 2160	4924	cmd.exe	110
PID 2820 wrote to memory of 1516	2820	cmd.exe	111
PID 2820 wrote to memory of 996	2820	cmd.exe	112
PID 2820 wrote to memory of 1056	2820	cmd.exe	113
PID 624 wrote to memory of 1148	624	cmd.exe	114
PID 2820 wrote to memory of 732	2820	cmd.exe	115
PID 2820 wrote to memory of 3996	2820	cmd.exe	116
PID 624 wrote to memory of 3520	624	cmd.exe	117
PID 624 wrote to memory of 868	624	cmd.exe	118
PID 2820 wrote to memory of 1724	2820	cmd.exe	119
PID 624 wrote to memory of 4236	624	cmd.exe	120
PID 624 wrote to memory of 3432	624	cmd.exe	121
PID 624 wrote to memory of 3168	624	cmd.exe	122
PID 2820 wrote to memory of 3492	2820	cmd.exe	123
PID 2820 wrote to memory of 3824	2820	cmd.exe	124
PID 624 wrote to memory of 376	624	cmd.exe	125
PID 2820 wrote to memory of 8	2820	cmd.exe	126
PID 2820 wrote to memory of 2376	2820	cmd.exe	127
PID 2820 wrote to memory of 3248	2820	cmd.exe	128
PID 624 wrote to memory of 3116	624	cmd.exe	129
PID 624 wrote to memory of 2900	624	cmd.exe	130
PID 2820 wrote to memory of 4080	2820	cmd.exe	131
PID 624 wrote to memory of 2720	624	cmd.exe	132
PID 2820 wrote to memory of 1420	2820	cmd.exe	133
PID 2820 wrote to memory of 4624	2820	cmd.exe	134
PID 624 wrote to memory of 4620	624	cmd.exe	135
PID 624 wrote to memory of 4988	624	cmd.exe	136
PID 2820 wrote to memory of 464	2820	cmd.exe	137
PID 624 wrote to memory of 772	624	cmd.exe	138
PID 624 wrote to memory of 3576	624	cmd.exe	139
PID 624 wrote to memory of 1476	624	cmd.exe	140
PID 2820 wrote to memory of 2576	2820	cmd.exe	141
PID 2820 wrote to memory of 2356	2820	cmd.exe	142
PID 624 wrote to memory of 2332	624	cmd.exe	143
PID 2820 wrote to memory of 740	2820	cmd.exe	144
PID 624 wrote to memory of 3632	624	cmd.exe	146
PID 624 wrote to memory of 1508	624	cmd.exe	147
PID 2820 wrote to memory of 4144	2820	cmd.exe	148
PID 2820 wrote to memory of 4508	2820	cmd.exe	149
PID 2820 wrote to memory of 2960	2820	cmd.exe	150
PID 624 wrote to memory of 3152	624	cmd.exe	151
PID 624 wrote to memory of 3900	624	cmd.exe	152
PID 624 wrote to memory of 2384	624	cmd.exe	153
PID 2820 wrote to memory of 3460	2820	cmd.exe	154
PID 2820 wrote to memory of 3732	2820	cmd.exe	155
PID 624 wrote to memory of 4304	624	cmd.exe	156
PID 2820 wrote to memory of 4260	2820	cmd.exe	157
PID 2820 wrote to memory of 5044	2820	cmd.exe	158
PID 2820 wrote to memory of 4928	2820	cmd.exe	159
PID 624 wrote to memory of 1516	624	cmd.exe	160
PID 624 wrote to memory of 3768	624	cmd.exe	161
PID 2820 wrote to memory of 4148	2820	cmd.exe	162
PID 624 wrote to memory of 1704	624	cmd.exe	163
PID 2820 wrote to memory of 4592	2820	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-11_295bd5140c2570b1c24d667d585f3728_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_295bd5140c2570b1c24d667d585f3728_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3168
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:376
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4620
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3576
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1508
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4968
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1764
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:976
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3768
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4440
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4592
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3236
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1304
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4168
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4916
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3592
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:436
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:224
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1504
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3152
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1812
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4936

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3824
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:8
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:740
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4508
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2960
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4928
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4640
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4388
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:856
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2464
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4768
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4492
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4884
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4284
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3644
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3680
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3856
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3196
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
MD5 b594c0a5591fab95a43185dd9944a231
SHA1 3d725e779790f3525ba12b0666f0a3a235644fed
SHA512 452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73
TLSH
T1C7112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jvm35gqm.eks.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvm35gqm.eks.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 9.5MB
SHA256 c15754845e9d525115d573365fd70b8540ce40e57e113ffbcf645a1946ed1956
MD5 31ede5abe0386a8ccb687d638e9ed358
SHA1 0b40de09af50c66fc51d4a5fb477bbcc5b62fb3b
SHA512 acf7e44c6dc313bec526873014f3e868f1df4f942a9cfc498a6d0ff5f0ed082ed16ce4495372dbe05e7195835e1fc2dac48bf83e100425387effe2c995f42049
SSDEEP 196608:++hx9ekhByQyVG/uzGNVyAl3K8fCGnbP3JHByQyVG/uzGNVyAl3K8fCGq:h9eENSG/lVrl3KExL3JhNSG/lVrl3KEA
TLSH
T17BA6126B726901E8D1BFD17C89065907EBB2780543A0A7CF16E046A62FB7BE14F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-28-0x00000297FDCD0000-0x00000297FDCF2000-memory.dmp

Download