2e4fe6d0659a17725c8f353a05de836ef92557d13504aac29735c4337406a004

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_2141f4887d4caef499a8d1d82d1c9d7e_icedid_njrat_stealc.exe
Size 3.9MB
Sample260919-ftcseabf39
SHA256 2e4fe6d0659a17725c8f353a05de836ef92557d13504aac29735c4337406a004
MD5 2141f4887d4caef499a8d1d82d1c9d7e
SHA1 54a5ed5374db206b0ac41a9f5a2366a1feefcefe
SHA512 d46e6c3d8e7c1604cf065c5a0f81ebaf82bd99fd936074e01cae6fee27be518890238933b13e509039639e040db46bbb538b213a4c29f159f9b0afa968e21d94
SSDEEP 98304:s+hxpLJlKkvsWWGoqZ92yVG/uzGNV9HkY:s+hx9ekExByQyVG/uzGNVyY
TLSH
T1D716D02BB26901E8D1BFD17CC9165907EBB2780543A0A7DF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4296	powershell.exe
5540	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3508	PeerService.exe
1184	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2540	tasklist.exe
5360	tasklist.exe
2932	tasklist.exe
1504	tasklist.exe
5064	tasklist.exe
4192	tasklist.exe
2512	tasklist.exe
1396	tasklist.exe
5096	tasklist.exe
5516	tasklist.exe
6120	tasklist.exe
1760	tasklist.exe
752	tasklist.exe
1932	tasklist.exe
5776	tasklist.exe
5676	tasklist.exe
4276	tasklist.exe
5824	tasklist.exe
2052	tasklist.exe
2248	tasklist.exe
2552	tasklist.exe
2816	tasklist.exe
3428	tasklist.exe
3948	tasklist.exe
468	tasklist.exe
4300	tasklist.exe
5304	tasklist.exe
1936	tasklist.exe
1900	tasklist.exe
3260	tasklist.exe
6060	tasklist.exe
4860	tasklist.exe
4104	tasklist.exe
5396	tasklist.exe
2992	tasklist.exe
2884	tasklist.exe
3304	tasklist.exe
4424	tasklist.exe
5256	tasklist.exe
2388	tasklist.exe
4296	tasklist.exe
2116	tasklist.exe
1728	tasklist.exe
5520	tasklist.exe
1124	tasklist.exe
2588	tasklist.exe
4768	tasklist.exe
6068	tasklist.exe
5360	tasklist.exe
1080	tasklist.exe
5172	tasklist.exe
1368	tasklist.exe
5696	tasklist.exe
5984	tasklist.exe
4932	tasklist.exe
2828	tasklist.exe
2068	tasklist.exe
5856	tasklist.exe
4620	tasklist.exe
5332	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5888	cmd.exe
3112	cmd.exe
2880	cmd.exe
2240	cmd.exe
936	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1468	timeout.exe
2472	timeout.exe
2180	timeout.exe
3988	timeout.exe
1936	timeout.exe
5392	timeout.exe
2220	timeout.exe
2108	timeout.exe
1868	timeout.exe
3788	timeout.exe
4312	timeout.exe
2564	timeout.exe
900	timeout.exe
4360	timeout.exe
3872	timeout.exe
4988	timeout.exe
4896	timeout.exe
2592	timeout.exe
1540	timeout.exe
5204	timeout.exe
3456	timeout.exe
3500	timeout.exe
1736	timeout.exe
4140	timeout.exe
2676	timeout.exe
5868	timeout.exe
5468	timeout.exe
1472	timeout.exe
2528	timeout.exe
5124	timeout.exe
872	timeout.exe
3212	timeout.exe
244	timeout.exe
5596	timeout.exe
1548	timeout.exe
2396	timeout.exe
5196	timeout.exe
4296	timeout.exe
2780	timeout.exe
5936	timeout.exe
1868	timeout.exe
3988	timeout.exe
6040	timeout.exe
1240	timeout.exe
4844	timeout.exe
5540	timeout.exe
5220	timeout.exe
6052	timeout.exe
2060	timeout.exe
3016	timeout.exe
1256	timeout.exe
4728	timeout.exe
1144	timeout.exe
4104	timeout.exe
1548	timeout.exe
4624	timeout.exe
4968	timeout.exe
1020	timeout.exe
1760	timeout.exe
3804	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
5540	powershell.exe
5540	powershell.exe
5540	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	tasklist.exe
Token: SeDebugPrivilege	5304	tasklist.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe
Token: SeCreatePagefilePrivilege	4296	powershell.exe
Token: SeBackupPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	powershell.exe
Token: SeRemoteShutdownPrivilege	4296	powershell.exe
Token: SeUndockPrivilege	4296	powershell.exe
Token: SeManageVolumePrivilege	4296	powershell.exe
Token: 33	4296	powershell.exe
Token: 34	4296	powershell.exe
Token: 35	4296	powershell.exe
Token: 36	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	5540	powershell.exe
Token: SeSecurityPrivilege	5540	powershell.exe
Token: SeTakeOwnershipPrivilege	5540	powershell.exe
Token: SeLoadDriverPrivilege	5540	powershell.exe
Token: SeSystemProfilePrivilege	5540	powershell.exe
Token: SeSystemtimePrivilege	5540	powershell.exe
Token: SeProfSingleProcessPrivilege	5540	powershell.exe
Token: SeIncBasePriorityPrivilege	5540	powershell.exe
Token: SeCreatePagefilePrivilege	5540	powershell.exe
Token: SeBackupPrivilege	5540	powershell.exe
Token: SeRestorePrivilege	5540	powershell.exe
Token: SeShutdownPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeSystemEnvironmentPrivilege	5540	powershell.exe
Token: SeRemoteShutdownPrivilege	5540	powershell.exe
Token: SeUndockPrivilege	5540	powershell.exe
Token: SeManageVolumePrivilege	5540	powershell.exe
Token: 33	5540	powershell.exe
Token: 34	5540	powershell.exe
Token: 35	5540	powershell.exe
Token: 36	5540	powershell.exe
Token: SeDebugPrivilege	1936	tasklist.exe
Token: SeDebugPrivilege	1080	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	2116	tasklist.exe
Token: SeDebugPrivilege	5256	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	5776	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeDebugPrivilege	5360	tasklist.exe
Token: SeDebugPrivilege	2932	tasklist.exe
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	5396	tasklist.exe
Token: SeDebugPrivilege	1728	tasklist.exe
Token: SeDebugPrivilege	6060	tasklist.exe
Token: SeDebugPrivilege	5520	tasklist.exe
Token: SeDebugPrivilege	5984	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5888	4604	2026-09-19_2141f4887d4caef499a8d1d82d1c9d7e_icedid_njrat_stealc.exe	90
PID 5888 wrote to memory of 3816	5888	cmd.exe	92
PID 4604 wrote to memory of 3508	4604	2026-09-19_2141f4887d4caef499a8d1d82d1c9d7e_icedid_njrat_stealc.exe	93
PID 3508 wrote to memory of 3112	3508	PeerService.exe	96
PID 3508 wrote to memory of 2880	3508	PeerService.exe	98
PID 1184 wrote to memory of 936	1184	PeerService.exe	101
PID 1184 wrote to memory of 2240	1184	PeerService.exe	102
PID 3112 wrote to memory of 4296	3112	cmd.exe	106
PID 2880 wrote to memory of 4860	2880	cmd.exe	107
PID 2880 wrote to memory of 1932	2880	cmd.exe	108
PID 2240 wrote to memory of 5304	2240	cmd.exe	109
PID 2240 wrote to memory of 6060	2240	cmd.exe	110
PID 936 wrote to memory of 5540	936	cmd.exe	111
PID 2240 wrote to memory of 5220	2240	cmd.exe	114
PID 2880 wrote to memory of 3456	2880	cmd.exe	115
PID 2880 wrote to memory of 1936	2880	cmd.exe	116
PID 2880 wrote to memory of 4124	2880	cmd.exe	117
PID 2240 wrote to memory of 1080	2240	cmd.exe	118
PID 2240 wrote to memory of 3216	2240	cmd.exe	119
PID 2880 wrote to memory of 1868	2880	cmd.exe	120
PID 2240 wrote to memory of 4968	2240	cmd.exe	121
PID 2880 wrote to memory of 1900	2880	cmd.exe	122
PID 2880 wrote to memory of 6132	2880	cmd.exe	123
PID 2240 wrote to memory of 5064	2240	cmd.exe	124
PID 2240 wrote to memory of 4432	2240	cmd.exe	125
PID 2880 wrote to memory of 5468	2880	cmd.exe	126
PID 2240 wrote to memory of 3872	2240	cmd.exe	127
PID 2240 wrote to memory of 4620	2240	cmd.exe	128
PID 2240 wrote to memory of 2676	2240	cmd.exe	129
PID 2880 wrote to memory of 2116	2880	cmd.exe	130
PID 2880 wrote to memory of 4996	2880	cmd.exe	131
PID 2880 wrote to memory of 1020	2880	cmd.exe	132
PID 2240 wrote to memory of 5204	2240	cmd.exe	133
PID 2880 wrote to memory of 5256	2880	cmd.exe	134
PID 2880 wrote to memory of 1124	2880	cmd.exe	135
PID 2240 wrote to memory of 4104	2240	cmd.exe	136
PID 2240 wrote to memory of 1688	2240	cmd.exe	137
PID 2880 wrote to memory of 2220	2880	cmd.exe	138
PID 2240 wrote to memory of 3016	2240	cmd.exe	139
PID 2240 wrote to memory of 5776	2240	cmd.exe	140
PID 2240 wrote to memory of 4608	2240	cmd.exe	141
PID 2880 wrote to memory of 2540	2880	cmd.exe	142
PID 2880 wrote to memory of 4520	2880	cmd.exe	143
PID 2240 wrote to memory of 1760	2240	cmd.exe	144
PID 2880 wrote to memory of 3500	2880	cmd.exe	145
PID 2240 wrote to memory of 5360	2240	cmd.exe	147
PID 2240 wrote to memory of 2816	2240	cmd.exe	148
PID 2880 wrote to memory of 2932	2880	cmd.exe	149
PID 2880 wrote to memory of 2020	2880	cmd.exe	150
PID 2240 wrote to memory of 4988	2240	cmd.exe	151
PID 2880 wrote to memory of 1548	2880	cmd.exe	152
PID 2240 wrote to memory of 3260	2240	cmd.exe	153
PID 2240 wrote to memory of 1764	2240	cmd.exe	154
PID 2880 wrote to memory of 5396	2880	cmd.exe	155
PID 2880 wrote to memory of 4488	2880	cmd.exe	156
PID 2240 wrote to memory of 3788	2240	cmd.exe	157
PID 2880 wrote to memory of 3804	2880	cmd.exe	158
PID 2240 wrote to memory of 1728	2240	cmd.exe	159
PID 2240 wrote to memory of 256	2240	cmd.exe	160
PID 2880 wrote to memory of 6060	2880	cmd.exe	161
PID 2880 wrote to memory of 6100	2880	cmd.exe	162
PID 2240 wrote to memory of 1468	2240	cmd.exe	163
PID 2880 wrote to memory of 1736	2880	cmd.exe	164
PID 2880 wrote to memory of 5520	2880	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-19_2141f4887d4caef499a8d1d82d1c9d7e_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_2141f4887d4caef499a8d1d82d1c9d7e_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3816
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4296
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1932
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1936
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6132
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4996
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4520
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5396
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1556
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4192
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2168
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1396
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5516
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4784
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2676
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3948
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:120
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3304
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6068
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4236
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1504
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4300
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3844
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:872
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2248
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5848
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1268
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5596

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6060
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3216
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4968
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1688
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4608
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2816
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:256
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2620
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5172
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6052
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5676
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5892
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1124
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1256
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3740
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4768
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1944
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1520
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3872
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1488
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4728
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3428
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4276
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1264
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1368
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1324
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:468
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4876
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2528
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4488
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1868
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5856
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3144
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5696
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6132
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_g4d5zusd.4cd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4d5zusd.4cd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.3MB
SHA256 bd37499c15749eb00d477e9960531308d5c7fec68da17f0cd7611da43ad002c6
MD5 a703d18a22d5f900ce3e5e32a8ff943d
SHA1 15e2bfa99c255301a5f410061af3f6a6617db833
SHA512 2abd9251bc830f5891a56677e8665c1da336ffb91a0ee728ba69da1802236d52552986db30fa6e5199bfe8afc2b4906d792112e45610ffeb1780f41fede509db
SSDEEP 196608:s+hx9ekE9ByQyVG/uzGNVyAl3K8fCGnbP3JzAs:L9eRNSG/lVrl3KExL3JzAs
TLSH
T16966012BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4296-14-0x0000015A555A0000-0x0000015A555C2000-memory.dmp

Download

memory/4296-19-0x0000015A55850000-0x0000015A5586E000-memory.dmp

Download

memory/4296-20-0x0000015A55870000-0x0000015A55922000-memory.dmp

Download

memory/4296-21-0x0000015A55930000-0x0000015A5593A000-memory.dmp

Download

memory/4296-25-0x0000015A55B90000-0x0000015A55C80000-memory.dmp

Download

memory/5540-28-0x0000019864260000-0x0000019864350000-memory.dmp

Download