5abb3a70290c7612504d5d772ab88067426243c1ed6a028c7bc08a33ffa60a3a

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_26ec9732cf998a6e9515bda1780dd9af_icedid_njrat_stealc.exe
Size 3.6MB
Sample261003-1c46jsff64
SHA256 5abb3a70290c7612504d5d772ab88067426243c1ed6a028c7bc08a33ffa60a3a
MD5 26ec9732cf998a6e9515bda1780dd9af
SHA1 f9dc9208bb581eb03ffe405a2f7e339c67a58056
SHA512 c93e98c691ff59c06e02dd4d28f10ebc2c3c9eebcd4782999f2ecea834aeffd7353ecc9b68e0999c9b4f644f3d43267fdc8c55ef7183541e56b432bdc6e7ef42
SSDEEP 49152:C++Mx9P91XZhIl8pFJ8HsKkZrn/SHLiQu2XG8ZoI9Z9rqyI44HppuzGxHHY4Lc:C+hxpLJlKkhsBWGoqZ92yVG/uzGNVw
TLSH
T18406C02BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5692	powershell.exe
1216	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6032	PeerService.exe
416	PeerService.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2544	tasklist.exe
1044	tasklist.exe
96	tasklist.exe
3200	tasklist.exe
4744	tasklist.exe
2284	tasklist.exe
4360	tasklist.exe
1556	tasklist.exe
4116	tasklist.exe
5780	tasklist.exe
2548	tasklist.exe
1904	tasklist.exe
3048	tasklist.exe
4612	tasklist.exe
2164	tasklist.exe
1260	tasklist.exe
5140	tasklist.exe
5376	tasklist.exe
4832	tasklist.exe
1140	tasklist.exe
3376	tasklist.exe
3416	tasklist.exe
4484	tasklist.exe
1856	tasklist.exe
200	tasklist.exe
2628	tasklist.exe
4540	tasklist.exe
588	tasklist.exe
3204	tasklist.exe
5092	tasklist.exe
5692	tasklist.exe
4528	tasklist.exe
1228	tasklist.exe
4316	tasklist.exe
4656	tasklist.exe
5744	tasklist.exe
4972	tasklist.exe
2836	tasklist.exe
2524	tasklist.exe
1692	tasklist.exe
4336	tasklist.exe
4464	tasklist.exe
616	tasklist.exe
4916	tasklist.exe
5604	tasklist.exe
5628	tasklist.exe
2888	tasklist.exe
4164	tasklist.exe
3400	tasklist.exe
5296	tasklist.exe
4672	tasklist.exe
2980	tasklist.exe
5068	tasklist.exe
1196	tasklist.exe
6040	tasklist.exe
6068	tasklist.exe
4640	tasklist.exe
4748	tasklist.exe
904	tasklist.exe
1512	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2136	cmd.exe
5720	cmd.exe
2508	cmd.exe
6048	cmd.exe
2080	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3336	timeout.exe
4104	timeout.exe
480	timeout.exe
5800	timeout.exe
3016	timeout.exe
3264	timeout.exe
1860	timeout.exe
5796	timeout.exe
2692	timeout.exe
2492	timeout.exe
3920	timeout.exe
3604	timeout.exe
3148	timeout.exe
3568	timeout.exe
1304	timeout.exe
1220	timeout.exe
1056	timeout.exe
4788	timeout.exe
4952	timeout.exe
1732	timeout.exe
3432	timeout.exe
5240	timeout.exe
6104	timeout.exe
360	timeout.exe
5144	timeout.exe
4224	timeout.exe
5496	timeout.exe
3568	timeout.exe
5032	timeout.exe
3424	timeout.exe
3452	timeout.exe
5344	timeout.exe
1520	timeout.exe
6012	timeout.exe
5272	timeout.exe
5556	timeout.exe
744	timeout.exe
432	timeout.exe
2360	timeout.exe
4464	timeout.exe
1288	timeout.exe
4512	timeout.exe
2324	timeout.exe
5644	timeout.exe
5008	timeout.exe
1888	timeout.exe
2704	timeout.exe
4632	timeout.exe
2240	timeout.exe
4120	timeout.exe
3440	timeout.exe
5508	timeout.exe
4248	timeout.exe
4948	timeout.exe
3872	timeout.exe
4984	timeout.exe
5048	timeout.exe
992	timeout.exe
5112	timeout.exe
4552	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5692	powershell.exe
5692	powershell.exe
1216	powershell.exe
1216	powershell.exe
5692	powershell.exe
1216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	588	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1216	powershell.exe
Token: SeSecurityPrivilege	1216	powershell.exe
Token: SeTakeOwnershipPrivilege	1216	powershell.exe
Token: SeLoadDriverPrivilege	1216	powershell.exe
Token: SeSystemProfilePrivilege	1216	powershell.exe
Token: SeSystemtimePrivilege	1216	powershell.exe
Token: SeProfSingleProcessPrivilege	1216	powershell.exe
Token: SeIncBasePriorityPrivilege	1216	powershell.exe
Token: SeCreatePagefilePrivilege	1216	powershell.exe
Token: SeBackupPrivilege	1216	powershell.exe
Token: SeRestorePrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeSystemEnvironmentPrivilege	1216	powershell.exe
Token: SeRemoteShutdownPrivilege	1216	powershell.exe
Token: SeUndockPrivilege	1216	powershell.exe
Token: SeManageVolumePrivilege	1216	powershell.exe
Token: 33	1216	powershell.exe
Token: 34	1216	powershell.exe
Token: 35	1216	powershell.exe
Token: 36	1216	powershell.exe
Token: SeIncreaseQuotaPrivilege	5692	powershell.exe
Token: SeSecurityPrivilege	5692	powershell.exe
Token: SeTakeOwnershipPrivilege	5692	powershell.exe
Token: SeLoadDriverPrivilege	5692	powershell.exe
Token: SeSystemProfilePrivilege	5692	powershell.exe
Token: SeSystemtimePrivilege	5692	powershell.exe
Token: SeProfSingleProcessPrivilege	5692	powershell.exe
Token: SeIncBasePriorityPrivilege	5692	powershell.exe
Token: SeCreatePagefilePrivilege	5692	powershell.exe
Token: SeBackupPrivilege	5692	powershell.exe
Token: SeRestorePrivilege	5692	powershell.exe
Token: SeShutdownPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeSystemEnvironmentPrivilege	5692	powershell.exe
Token: SeRemoteShutdownPrivilege	5692	powershell.exe
Token: SeUndockPrivilege	5692	powershell.exe
Token: SeManageVolumePrivilege	5692	powershell.exe
Token: 33	5692	powershell.exe
Token: 34	5692	powershell.exe
Token: 35	5692	powershell.exe
Token: 36	5692	powershell.exe
Token: SeDebugPrivilege	616	tasklist.exe
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeDebugPrivilege	3376	tasklist.exe
Token: SeDebugPrivilege	2548	tasklist.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	3416	tasklist.exe
Token: SeDebugPrivilege	4656	tasklist.exe
Token: SeDebugPrivilege	3204	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	1260	tasklist.exe
Token: SeDebugPrivilege	5628	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	5140	tasklist.exe
Token: SeDebugPrivilege	3400	tasklist.exe
Token: SeDebugPrivilege	3048	tasklist.exe
Token: SeDebugPrivilege	5092	tasklist.exe
Token: SeDebugPrivilege	5692	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2136	3228	2026-10-01_26ec9732cf998a6e9515bda1780dd9af_icedid_njrat_stealc.exe	89
PID 2136 wrote to memory of 5164	2136	cmd.exe	91
PID 3228 wrote to memory of 6032	3228	2026-10-01_26ec9732cf998a6e9515bda1780dd9af_icedid_njrat_stealc.exe	93
PID 6032 wrote to memory of 2508	6032	PeerService.exe	95
PID 6032 wrote to memory of 5720	6032	PeerService.exe	96
PID 2508 wrote to memory of 5692	2508	cmd.exe	102
PID 416 wrote to memory of 6048	416	PeerService.exe	101
PID 416 wrote to memory of 2080	416	PeerService.exe	103
PID 5720 wrote to memory of 4464	5720	cmd.exe	104
PID 5720 wrote to memory of 3264	5720	cmd.exe	106
PID 6048 wrote to memory of 1216	6048	cmd.exe	108
PID 2080 wrote to memory of 588	2080	cmd.exe	109
PID 2080 wrote to memory of 3800	2080	cmd.exe	110
PID 5720 wrote to memory of 480	5720	cmd.exe	113
PID 2080 wrote to memory of 4952	2080	cmd.exe	114
PID 5720 wrote to memory of 616	5720	cmd.exe	115
PID 5720 wrote to memory of 4760	5720	cmd.exe	116
PID 2080 wrote to memory of 5780	2080	cmd.exe	117
PID 2080 wrote to memory of 4308	2080	cmd.exe	118
PID 5720 wrote to memory of 3568	5720	cmd.exe	119
PID 2080 wrote to memory of 4120	2080	cmd.exe	120
PID 2080 wrote to memory of 3376	2080	cmd.exe	121
PID 2080 wrote to memory of 4084	2080	cmd.exe	122
PID 5720 wrote to memory of 2548	5720	cmd.exe	123
PID 5720 wrote to memory of 968	5720	cmd.exe	124
PID 2080 wrote to memory of 1888	2080	cmd.exe	125
PID 5720 wrote to memory of 3604	5720	cmd.exe	126
PID 2080 wrote to memory of 4916	2080	cmd.exe	127
PID 2080 wrote to memory of 3040	2080	cmd.exe	128
PID 5720 wrote to memory of 904	5720	cmd.exe	129
PID 5720 wrote to memory of 4888	5720	cmd.exe	130
PID 2080 wrote to memory of 3440	2080	cmd.exe	131
PID 5720 wrote to memory of 5508	5720	cmd.exe	132
PID 2080 wrote to memory of 3416	2080	cmd.exe	133
PID 2080 wrote to memory of 5524	2080	cmd.exe	134
PID 5720 wrote to memory of 4656	5720	cmd.exe	135
PID 5720 wrote to memory of 4380	5720	cmd.exe	136
PID 2080 wrote to memory of 3148	2080	cmd.exe	137
PID 5720 wrote to memory of 3336	5720	cmd.exe	138
PID 5720 wrote to memory of 3204	5720	cmd.exe	139
PID 5720 wrote to memory of 4752	5720	cmd.exe	140
PID 2080 wrote to memory of 1692	2080	cmd.exe	141
PID 2080 wrote to memory of 3452	2080	cmd.exe	142
PID 5720 wrote to memory of 992	5720	cmd.exe	143
PID 2080 wrote to memory of 5032	2080	cmd.exe	144
PID 2080 wrote to memory of 1260	2080	cmd.exe	146
PID 2080 wrote to memory of 1244	2080	cmd.exe	147
PID 5720 wrote to memory of 5628	5720	cmd.exe	148
PID 5720 wrote to memory of 5456	5720	cmd.exe	149
PID 2080 wrote to memory of 5496	2080	cmd.exe	150
PID 5720 wrote to memory of 2704	5720	cmd.exe	151
PID 2080 wrote to memory of 2284	2080	cmd.exe	152
PID 2080 wrote to memory of 2584	2080	cmd.exe	153
PID 5720 wrote to memory of 5140	5720	cmd.exe	154
PID 5720 wrote to memory of 4160	5720	cmd.exe	155
PID 2080 wrote to memory of 3016	2080	cmd.exe	156
PID 5720 wrote to memory of 432	5720	cmd.exe	157
PID 2080 wrote to memory of 3400	2080	cmd.exe	158
PID 2080 wrote to memory of 1688	2080	cmd.exe	159
PID 5720 wrote to memory of 3048	5720	cmd.exe	160
PID 5720 wrote to memory of 1960	5720	cmd.exe	161
PID 2080 wrote to memory of 1520	2080	cmd.exe	162
PID 5720 wrote to memory of 2692	5720	cmd.exe	163
PID 5720 wrote to memory of 5092	5720	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-01_26ec9732cf998a6e9515bda1780dd9af_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_26ec9732cf998a6e9515bda1780dd9af_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5164
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5692
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3264
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:616
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4760
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:968
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:904
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4888
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4656
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3336
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3204
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4752
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5456
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4160
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3048
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1960
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5092
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5748
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3200
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5376
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4504
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2888
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5048
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4164
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5912
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5716
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2828
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1228
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:588
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5188
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:200
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4764
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:96
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2164
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:744

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:588
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4308
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5524
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1244
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2584
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1688
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6040
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5000
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1304
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4540
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1876
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3032
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4632
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1556
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4252
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5240
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1044
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3432
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4336
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2836
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4832
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4308
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1856
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4612
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3180
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6068
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4248
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4640
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2980
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1600
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2492
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5068
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1132
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4512
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5168
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mjoqvskl.sy2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mjoqvskl.sy2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 3.9MB
SHA256 8f85d4ddd57c4c58bdd8f5de06bab247746aabe06c5faf3a4a3f316b47eeb815
MD5 86b4631dfc255d6742f9326479148d0a
SHA1 857c0d82931446789b64ec6ff3553905534435ce
SHA512 cd880390c9fa7631d1725c8c31e522e94fc883691c59bdce0d01f1578b3df36cfc3156621eece3940d3aa5043037f9a0dfc4555c34041878967a0e8424a452f4
SSDEEP 98304:C+hxpLJlKkhs1WGoqZ92yVG/uzGNV9HkU:C+hx9ekiYByQyVG/uzGNVyU
TLSH
T13F16D02BB26901E8D1BFD17CC9165907EBB2780543A0A7DF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-40-0x00000204712C0000-0x00000204712CA000-memory.dmp

Download

memory/5692-18-0x00000239AA7B0000-0x00000239AA7D2000-memory.dmp

Download

memory/5692-37-0x00000239AAA60000-0x00000239AAA7E000-memory.dmp

Download

memory/5692-39-0x00000239AAA80000-0x00000239AAB32000-memory.dmp

Download