20968aecbb1521ac145c2be162f2dd40425c1d31d6e633dcd2e55dbd57d86443

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_69f595e8dcef362165c80114601fcb25_icedid_njrat_stealc.exe
Size 5.8MB
Sample260930-mr16jsch59
SHA256 20968aecbb1521ac145c2be162f2dd40425c1d31d6e633dcd2e55dbd57d86443
MD5 69f595e8dcef362165c80114601fcb25
SHA1 5a6decfa572f66bbe26c14f6617132e48d7117ba
SHA512 bbef0e9c0ace7c2450ef2ad47f37c55c5fcc5f887ab26f4e366db462d283b1a264ff75b1278b85396e4a3246b87a0b45cb887e41793c23d4ecd58ea5a822faa0
SSDEEP 98304:u+hBp75lKkBcjWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWNr:u+hBtOkSKByQyVG/uzGNVyAl3K8fCGnR
TLSH
T12F56F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4628	powershell.exe
1992	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2260	PeerService.exe
2744	PeerService.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3476	tasklist.exe
4248	tasklist.exe
5368	tasklist.exe
5016	tasklist.exe
4628	tasklist.exe
1756	tasklist.exe
4828	tasklist.exe
260	tasklist.exe
5412	tasklist.exe
3068	tasklist.exe
5184	tasklist.exe
2804	tasklist.exe
2096	tasklist.exe
2000	tasklist.exe
4088	tasklist.exe
6092	tasklist.exe
3904	tasklist.exe
300	tasklist.exe
4188	tasklist.exe
2740	tasklist.exe
4316	tasklist.exe
2344	tasklist.exe
5468	tasklist.exe
4700	tasklist.exe
4716	tasklist.exe
3088	tasklist.exe
3500	tasklist.exe
3196	tasklist.exe
1116	tasklist.exe
1340	tasklist.exe
4704	tasklist.exe
3976	tasklist.exe
4196	tasklist.exe
3180	tasklist.exe
4748	tasklist.exe
2824	tasklist.exe
6012	tasklist.exe
4276	tasklist.exe
3356	tasklist.exe
1452	tasklist.exe
1992	tasklist.exe
5572	tasklist.exe
5724	tasklist.exe
3096	tasklist.exe
5124	tasklist.exe
4824	tasklist.exe
5776	tasklist.exe
1904	tasklist.exe
6132	tasklist.exe
5840	tasklist.exe
4728	tasklist.exe
6056	tasklist.exe
3312	tasklist.exe
2132	tasklist.exe
6112	tasklist.exe
4988	tasklist.exe
4172	tasklist.exe
2848	tasklist.exe
1444	tasklist.exe
1440	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2468	cmd.exe
3332	cmd.exe
4420	cmd.exe
3032	cmd.exe
5980	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 58 IoCs

defense_evasion

pid	Process
1352	timeout.exe
3352	timeout.exe
5356	timeout.exe
4756	timeout.exe
4760	timeout.exe
2384	timeout.exe
5252	timeout.exe
2448	timeout.exe
4624	timeout.exe
2496	timeout.exe
4520	timeout.exe
6060	timeout.exe
5900	timeout.exe
2864	timeout.exe
4652	timeout.exe
2252	timeout.exe
3392	timeout.exe
2384	timeout.exe
4092	timeout.exe
5076	timeout.exe
2224	timeout.exe
1172	timeout.exe
2444	timeout.exe
2740	timeout.exe
2024	timeout.exe
4540	timeout.exe
4680	timeout.exe
4260	timeout.exe
5932	timeout.exe
6112	timeout.exe
2976	timeout.exe
5672	timeout.exe
6036	timeout.exe
2900	timeout.exe
5616	timeout.exe
2892	timeout.exe
4988	timeout.exe
2256	timeout.exe
5020	timeout.exe
2152	timeout.exe
6056	timeout.exe
5736	timeout.exe
1132	timeout.exe
5088	timeout.exe
1960	timeout.exe
2664	timeout.exe
3648	timeout.exe
2664	timeout.exe
2856	timeout.exe
5792	timeout.exe
3540	timeout.exe
2652	timeout.exe
2568	timeout.exe
1364	timeout.exe
5660	timeout.exe
2852	timeout.exe
1352	timeout.exe
2440	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4628	powershell.exe
4628	powershell.exe
1992	powershell.exe
1992	powershell.exe
1992	powershell.exe
4628	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	2000	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1992	powershell.exe
Token: SeSecurityPrivilege	1992	powershell.exe
Token: SeTakeOwnershipPrivilege	1992	powershell.exe
Token: SeLoadDriverPrivilege	1992	powershell.exe
Token: SeSystemProfilePrivilege	1992	powershell.exe
Token: SeSystemtimePrivilege	1992	powershell.exe
Token: SeProfSingleProcessPrivilege	1992	powershell.exe
Token: SeIncBasePriorityPrivilege	1992	powershell.exe
Token: SeCreatePagefilePrivilege	1992	powershell.exe
Token: SeBackupPrivilege	1992	powershell.exe
Token: SeRestorePrivilege	1992	powershell.exe
Token: SeShutdownPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeSystemEnvironmentPrivilege	1992	powershell.exe
Token: SeRemoteShutdownPrivilege	1992	powershell.exe
Token: SeUndockPrivilege	1992	powershell.exe
Token: SeManageVolumePrivilege	1992	powershell.exe
Token: 33	1992	powershell.exe
Token: 34	1992	powershell.exe
Token: 35	1992	powershell.exe
Token: 36	1992	powershell.exe
Token: SeIncreaseQuotaPrivilege	4628	powershell.exe
Token: SeSecurityPrivilege	4628	powershell.exe
Token: SeTakeOwnershipPrivilege	4628	powershell.exe
Token: SeLoadDriverPrivilege	4628	powershell.exe
Token: SeSystemProfilePrivilege	4628	powershell.exe
Token: SeSystemtimePrivilege	4628	powershell.exe
Token: SeProfSingleProcessPrivilege	4628	powershell.exe
Token: SeIncBasePriorityPrivilege	4628	powershell.exe
Token: SeCreatePagefilePrivilege	4628	powershell.exe
Token: SeBackupPrivilege	4628	powershell.exe
Token: SeRestorePrivilege	4628	powershell.exe
Token: SeShutdownPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeSystemEnvironmentPrivilege	4628	powershell.exe
Token: SeRemoteShutdownPrivilege	4628	powershell.exe
Token: SeUndockPrivilege	4628	powershell.exe
Token: SeManageVolumePrivilege	4628	powershell.exe
Token: 33	4628	powershell.exe
Token: 34	4628	powershell.exe
Token: 35	4628	powershell.exe
Token: 36	4628	powershell.exe
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	4248	tasklist.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeDebugPrivilege	6092	tasklist.exe
Token: SeDebugPrivilege	3904	tasklist.exe
Token: SeDebugPrivilege	3356	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	5368	tasklist.exe
Token: SeDebugPrivilege	4824	tasklist.exe
Token: SeDebugPrivilege	4196	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	1444	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	3312	tasklist.exe
Token: SeDebugPrivilege	2344	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2468	3344	2026-09-30_69f595e8dcef362165c80114601fcb25_icedid_njrat_stealc.exe	90
PID 2468 wrote to memory of 5816	2468	cmd.exe	92
PID 3344 wrote to memory of 2260	3344	2026-09-30_69f595e8dcef362165c80114601fcb25_icedid_njrat_stealc.exe	94
PID 2744 wrote to memory of 4420	2744	PeerService.exe	97
PID 2744 wrote to memory of 3332	2744	PeerService.exe	98
PID 2260 wrote to memory of 3032	2260	PeerService.exe	101
PID 2260 wrote to memory of 5980	2260	PeerService.exe	102
PID 4420 wrote to memory of 4628	4420	cmd.exe	105
PID 3332 wrote to memory of 3976	3332	cmd.exe	106
PID 3332 wrote to memory of 1312	3332	cmd.exe	107
PID 3032 wrote to memory of 1992	3032	cmd.exe	109
PID 5980 wrote to memory of 2000	5980	cmd.exe	110
PID 5980 wrote to memory of 5432	5980	cmd.exe	111
PID 3332 wrote to memory of 5076	3332	cmd.exe	114
PID 5980 wrote to memory of 2496	5980	cmd.exe	115
PID 3332 wrote to memory of 1904	3332	cmd.exe	116
PID 3332 wrote to memory of 5112	3332	cmd.exe	117
PID 5980 wrote to memory of 4088	5980	cmd.exe	118
PID 5980 wrote to memory of 6032	5980	cmd.exe	119
PID 3332 wrote to memory of 4260	3332	cmd.exe	120
PID 5980 wrote to memory of 2384	5980	cmd.exe	121
PID 5980 wrote to memory of 4316	5980	cmd.exe	122
PID 5980 wrote to memory of 3496	5980	cmd.exe	123
PID 3332 wrote to memory of 4248	3332	cmd.exe	124
PID 3332 wrote to memory of 3012	3332	cmd.exe	125
PID 5980 wrote to memory of 5932	5980	cmd.exe	126
PID 3332 wrote to memory of 5252	3332	cmd.exe	127
PID 5980 wrote to memory of 4716	5980	cmd.exe	128
PID 5980 wrote to memory of 796	5980	cmd.exe	129
PID 3332 wrote to memory of 6092	3332	cmd.exe	130
PID 3332 wrote to memory of 5312	3332	cmd.exe	131
PID 5980 wrote to memory of 6112	5980	cmd.exe	132
PID 3332 wrote to memory of 2856	3332	cmd.exe	133
PID 3332 wrote to memory of 3904	3332	cmd.exe	134
PID 3332 wrote to memory of 3564	3332	cmd.exe	135
PID 5980 wrote to memory of 3356	5980	cmd.exe	136
PID 5980 wrote to memory of 1500	5980	cmd.exe	137
PID 3332 wrote to memory of 2976	3332	cmd.exe	138
PID 5980 wrote to memory of 6060	5980	cmd.exe	139
PID 3332 wrote to memory of 2824	3332	cmd.exe	140
PID 3332 wrote to memory of 2532	3332	cmd.exe	141
PID 5980 wrote to memory of 5368	5980	cmd.exe	142
PID 5980 wrote to memory of 4188	5980	cmd.exe	143
PID 3332 wrote to memory of 2740	3332	cmd.exe	145
PID 5980 wrote to memory of 2024	5980	cmd.exe	146
PID 3332 wrote to memory of 4824	3332	cmd.exe	147
PID 3332 wrote to memory of 3184	3332	cmd.exe	149
PID 5980 wrote to memory of 4196	5980	cmd.exe	148
PID 5980 wrote to memory of 5468	5980	cmd.exe	150
PID 3332 wrote to memory of 5900	3332	cmd.exe	151
PID 5980 wrote to memory of 5356	5980	cmd.exe	152
PID 3332 wrote to memory of 1452	3332	cmd.exe	153
PID 3332 wrote to memory of 3880	3332	cmd.exe	154
PID 5980 wrote to memory of 1444	5980	cmd.exe	155
PID 5980 wrote to memory of 3536	5980	cmd.exe	156
PID 3332 wrote to memory of 2864	3332	cmd.exe	157
PID 5980 wrote to memory of 2256	5980	cmd.exe	158
PID 5980 wrote to memory of 4828	5980	cmd.exe	159
PID 5980 wrote to memory of 3732	5980	cmd.exe	160
PID 3332 wrote to memory of 1992	3332	cmd.exe	161
PID 3332 wrote to memory of 5584	3332	cmd.exe	162
PID 5980 wrote to memory of 4652	5980	cmd.exe	163
PID 3332 wrote to memory of 1172	3332	cmd.exe	164
PID 3332 wrote to memory of 3312	3332	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-30_69f595e8dcef362165c80114601fcb25_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_69f595e8dcef362165c80114601fcb25_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2496
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2384
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4716
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3356
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5368
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4188
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3536
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3732
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2344
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4244
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5016
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5364
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2992
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3180
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:260
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1012
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5724
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1440
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2384
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2848
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2684
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5124
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2060
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2892
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:300
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1608
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2192
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5840
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4276
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4700
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2020
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4308

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1312
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3012
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5252
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5312
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2976
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2740
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3184
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5584
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1312
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5020
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1340
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6032
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5184
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1736
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4704
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:828
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5412
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5468
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4196
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4628
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6132
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5164
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2804
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3012
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3068
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2568
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6012
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3648
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3476
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4188
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1756
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d5j53r2r.xr2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5j53r2r.xr2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 3.7MB
SHA256 9929f2119eba5531a880343879f46aeee882f68623764ff657fdd34d69505d15
MD5 1fd9cec57f964962475b3e7f91c33cf6
SHA1 2f8c9e1552e68aa82e729a46561afc6998809911
SHA512 7690123dc50d38da86f582b1a4c417403d99088e72ed6572c93fecafbb88b37e9b31c334199b7f387675a1220e2959a697d839c6081055b4ef2a1732dd696d0f
SSDEEP 49152:u++MB9P91XphIl8pF58HsKkZrXvCHLUQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q/:u+hBp75lKkBcvWGoqZ92yVG/uzGNV95
TLSH
T1D906D02BB26901ECD1BFD17CC9165907EBB2780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-16-0x000001EBFB130000-0x000001EBFB152000-memory.dmp

Download

memory/1992-19-0x000001EBFB400000-0x000001EBFB41E000-memory.dmp

Download

memory/1992-22-0x000001EBFB420000-0x000001EBFB4D2000-memory.dmp

Download

memory/4628-23-0x000001B3EEEC0000-0x000001B3EEECA000-memory.dmp

Download