1667977a98dc80788241da54ab3a2649ea257789768ad7c9965e68e03e8453c1

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_17ca20c713685e2b97ba88e0330a4871_icedid_njrat_stealc.exe
Size 7.0MB
Sample260913-v4fpdazhrf
SHA256 1667977a98dc80788241da54ab3a2649ea257789768ad7c9965e68e03e8453c1
MD5 17ca20c713685e2b97ba88e0330a4871
SHA1 5df490f78149eae63d338fa2d2afb763a19f51d0
SHA512 1bccc6c5356dbc89e2491c62ce96dfa4a8fdea80e80add708c08591e61ae2a9e71f6b2deffb76c0f93563de9dadf22da209ed44cbe192bba17fdd2a4f7808ae5
SSDEEP 196608:M+hx9ekEgByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CA:r9eCNSG/lVrl3KExL3JzATzCA
TLSH
T1FE76012BB26901E8E1BFD17CC9065907EBB2780543A097DF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe
4648	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-09-13_17ca20c713685e2b97ba88e0330a4871_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
900	PeerService.exe
1476	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5116	tasklist.exe
2208	tasklist.exe
3928	tasklist.exe
4048	tasklist.exe
892	tasklist.exe
976	tasklist.exe
4212	tasklist.exe
5060	tasklist.exe
1816	tasklist.exe
1240	tasklist.exe
4128	tasklist.exe
1244	tasklist.exe
4904	tasklist.exe
2152	tasklist.exe
3860	tasklist.exe
3296	tasklist.exe
844	tasklist.exe
2348	tasklist.exe
4056	tasklist.exe
960	tasklist.exe
4048	tasklist.exe
2024	tasklist.exe
2912	tasklist.exe
4640	tasklist.exe
4644	tasklist.exe
4604	tasklist.exe
4600	tasklist.exe
2344	tasklist.exe
4372	tasklist.exe
4444	tasklist.exe
3816	tasklist.exe
3904	tasklist.exe
2112	tasklist.exe
3388	tasklist.exe
4456	tasklist.exe
4688	tasklist.exe
4408	tasklist.exe
4172	tasklist.exe
2416	tasklist.exe
2940	tasklist.exe
3540	tasklist.exe
3104	tasklist.exe
4828	tasklist.exe
2288	tasklist.exe
4212	tasklist.exe
1000	tasklist.exe
1264	tasklist.exe
4952	tasklist.exe
3252	tasklist.exe
2156	tasklist.exe
3260	tasklist.exe
2444	tasklist.exe
4480	tasklist.exe
4944	tasklist.exe
4400	tasklist.exe
4880	tasklist.exe
2292	tasklist.exe
2444	tasklist.exe
2996	tasklist.exe
4188	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3804	cmd.exe
416	cmd.exe
4148	cmd.exe
3780	cmd.exe
3792	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3256	timeout.exe
4948	timeout.exe
3636	timeout.exe
5032	timeout.exe
176	timeout.exe
1720	timeout.exe
4952	timeout.exe
5100	timeout.exe
2548	timeout.exe
3132	timeout.exe
1740	timeout.exe
3204	timeout.exe
1904	timeout.exe
696	timeout.exe
1748	timeout.exe
3980	timeout.exe
1116	timeout.exe
2924	timeout.exe
4500	timeout.exe
4392	timeout.exe
5048	timeout.exe
2640	timeout.exe
2084	timeout.exe
3220	timeout.exe
60	timeout.exe
3388	timeout.exe
3296	timeout.exe
4532	timeout.exe
2972	timeout.exe
2548	timeout.exe
4460	timeout.exe
2232	timeout.exe
3224	timeout.exe
1756	timeout.exe
1932	timeout.exe
5044	timeout.exe
2368	timeout.exe
3092	timeout.exe
3360	timeout.exe
3228	timeout.exe
4324	timeout.exe
4260	timeout.exe
1572	timeout.exe
4444	timeout.exe
4912	timeout.exe
4644	timeout.exe
4856	timeout.exe
4428	timeout.exe
4376	timeout.exe
4904	timeout.exe
4080	timeout.exe
1444	timeout.exe
4912	timeout.exe
1744	timeout.exe
5104	timeout.exe
4120	timeout.exe
4952	timeout.exe
688	timeout.exe
3480	timeout.exe
2816	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4912	powershell.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
4912	powershell.exe
4912	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	tasklist.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	892	tasklist.exe
Token: SeDebugPrivilege	4904	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	2348	tasklist.exe
Token: SeDebugPrivilege	5116	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	1816	tasklist.exe
Token: SeDebugPrivilege	1240	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	2152	tasklist.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	2292	tasklist.exe
Token: SeDebugPrivilege	2208	tasklist.exe
Token: SeDebugPrivilege	2344	tasklist.exe
Token: SeDebugPrivilege	4372	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	2024	tasklist.exe
Token: SeDebugPrivilege	3388	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	3816	tasklist.exe
Token: SeDebugPrivilege	2156	tasklist.exe
Token: SeDebugPrivilege	3540	tasklist.exe
Token: SeDebugPrivilege	1000	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	4456	tasklist.exe
Token: SeDebugPrivilege	2912	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	3904	tasklist.exe
Token: SeDebugPrivilege	2996	tasklist.exe
Token: SeDebugPrivilege	4056	tasklist.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeDebugPrivilege	4688	tasklist.exe
Token: SeDebugPrivilege	960	tasklist.exe
Token: SeDebugPrivilege	3928	tasklist.exe
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	4880	tasklist.exe
Token: SeDebugPrivilege	3860	tasklist.exe
Token: SeDebugPrivilege	4600	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	1264	tasklist.exe
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	844	tasklist.exe
Token: SeDebugPrivilege	4408	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3804	760	2026-09-13_17ca20c713685e2b97ba88e0330a4871_icedid_njrat_stealc.exe	85
PID 3804 wrote to memory of 2664	3804	cmd.exe	87
PID 760 wrote to memory of 900	760	2026-09-13_17ca20c713685e2b97ba88e0330a4871_icedid_njrat_stealc.exe	89
PID 900 wrote to memory of 416	900	PeerService.exe	93
PID 900 wrote to memory of 4148	900	PeerService.exe	95
PID 416 wrote to memory of 4912	416	cmd.exe	97
PID 4148 wrote to memory of 2112	4148	cmd.exe	100
PID 4148 wrote to memory of 5108	4148	cmd.exe	101
PID 1476 wrote to memory of 3780	1476	PeerService.exe	102
PID 1476 wrote to memory of 3792	1476	PeerService.exe	103
PID 3780 wrote to memory of 4648	3780	cmd.exe	106
PID 3792 wrote to memory of 4048	3792	cmd.exe	107
PID 3792 wrote to memory of 756	3792	cmd.exe	108
PID 4148 wrote to memory of 3204	4148	cmd.exe	110
PID 3792 wrote to memory of 4500	3792	cmd.exe	111
PID 4148 wrote to memory of 4644	4148	cmd.exe	113
PID 4148 wrote to memory of 1184	4148	cmd.exe	114
PID 3792 wrote to memory of 2444	3792	cmd.exe	115
PID 3792 wrote to memory of 820	3792	cmd.exe	116
PID 4148 wrote to memory of 3224	4148	cmd.exe	117
PID 3792 wrote to memory of 4324	3792	cmd.exe	118
PID 4148 wrote to memory of 892	4148	cmd.exe	119
PID 4148 wrote to memory of 2748	4148	cmd.exe	120
PID 3792 wrote to memory of 4904	3792	cmd.exe	121
PID 3792 wrote to memory of 4796	3792	cmd.exe	122
PID 4148 wrote to memory of 3256	4148	cmd.exe	123
PID 3792 wrote to memory of 4260	3792	cmd.exe	124
PID 3792 wrote to memory of 2416	3792	cmd.exe	125
PID 4148 wrote to memory of 2348	4148	cmd.exe	126
PID 3792 wrote to memory of 4116	3792	cmd.exe	127
PID 4148 wrote to memory of 2208	4148	cmd.exe	128
PID 4148 wrote to memory of 2548	4148	cmd.exe	129
PID 3792 wrote to memory of 1904	3792	cmd.exe	130
PID 4148 wrote to memory of 5116	4148	cmd.exe	131
PID 4148 wrote to memory of 5092	4148	cmd.exe	132
PID 3792 wrote to memory of 4828	3792	cmd.exe	133
PID 3792 wrote to memory of 4204	3792	cmd.exe	134
PID 4148 wrote to memory of 60	4148	cmd.exe	135
PID 3792 wrote to memory of 4948	3792	cmd.exe	136
PID 3792 wrote to memory of 1816	3792	cmd.exe	137
PID 3792 wrote to memory of 3360	3792	cmd.exe	138
PID 4148 wrote to memory of 1240	4148	cmd.exe	139
PID 4148 wrote to memory of 4436	4148	cmd.exe	140
PID 3792 wrote to memory of 3388	3792	cmd.exe	141
PID 4148 wrote to memory of 5044	4148	cmd.exe	142
PID 4148 wrote to memory of 5060	4148	cmd.exe	145
PID 4148 wrote to memory of 116	4148	cmd.exe	146
PID 3792 wrote to memory of 4048	3792	cmd.exe	147
PID 3792 wrote to memory of 4680	3792	cmd.exe	148
PID 4148 wrote to memory of 1572	4148	cmd.exe	149
PID 3792 wrote to memory of 4444	3792	cmd.exe	150
PID 4148 wrote to memory of 2288	4148	cmd.exe	151
PID 4148 wrote to memory of 1808	4148	cmd.exe	152
PID 3792 wrote to memory of 4952	3792	cmd.exe	153
PID 3792 wrote to memory of 4228	3792	cmd.exe	154
PID 4148 wrote to memory of 4460	4148	cmd.exe	155
PID 3792 wrote to memory of 3296	3792	cmd.exe	156
PID 4148 wrote to memory of 4172	4148	cmd.exe	157
PID 4148 wrote to memory of 1656	4148	cmd.exe	158
PID 3792 wrote to memory of 4128	3792	cmd.exe	159
PID 3792 wrote to memory of 4180	3792	cmd.exe	160
PID 3792 wrote to memory of 2368	3792	cmd.exe	161
PID 4148 wrote to memory of 696	4148	cmd.exe	162
PID 3792 wrote to memory of 4212	3792	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-13_17ca20c713685e2b97ba88e0330a4871_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_17ca20c713685e2b97ba88e0330a4871_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2664
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5108
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4644
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:892
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2748
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2348
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2208
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5092
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:60
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4436
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1808
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1656
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4456
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:976
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4624
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4924
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2292
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2960
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4376
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:436
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1736
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3904
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:892
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4188
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2296
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4640
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3800
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1744

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:756
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:820
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4796
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1904
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4204
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3360
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3388
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4680
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4180
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:892
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4400
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3956
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:640
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4320
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1644
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5072
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3480
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:176
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1512
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4720
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2324
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1000
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291
MD5 71fa55c67a762ba70e40011153e19b3c
SHA1 a36d2bb4802a8ec7db1a68de5f0c3d6007987492
SHA512 32760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f
TLSH
T13C51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee20fb0a646520cbbea2c048126f7628085bf8a3f149dd453b8852844d9c650
MD5 2b757fcfd80533e2e11dca5713b74b37
SHA1 3158d75c2ca5ed926e41ca7572624a14c87dbd63
SHA512 b45a93eff264fb0732daeec91ebe53c0256770129818e370d30f248e0e238fb48c73f9926eaa8d2f6669c96b118d0b23233a45be231f6b7c29955475ffcc28f3
TLSH
T11A112223F7CC8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dsoxxsdh.nq5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsoxxsdh.nq5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 11.3MB
SHA256 efcbbf524eaa328a2a6bec1a04c4fb6710125d0d5309df486b2522cf51912219
MD5 1471d541cfe4545f9f0746e8a88e72c0
SHA1 f740796e22432a33277153c4ba4ee6b9fbd82e2a
SHA512 526d2f78ba9a40875c2d2e49abfd7ae4b9bce837571da964d9fbe19a163514f0e2e8f372326a96dc43b4ba4036c87ab6b48009f08de3ad71548ecfcdb59a0ecf
SSDEEP 196608:M+hx9ekEgByQyVG/uzGNVyAl3K8fCGnbP3JzATC4CQByQyVG/uzGNVyAl3K8fCGT:r9eCNSG/lVrl3KExL3JzATzCQNSG/lVn
TLSH
T193C6126BB26901E8E1BFD07CC9065907FBB2780543A096DF16E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4912-27-0x0000018670950000-0x0000018670972000-memory.dmp

Download