4a745392873ad9596f7c4423d66a2f6b1842e3f9dbc7aa1b29089691f365ce73

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_84453cfe16d9f5435f3b4225aae64345_icedid_njrat_stealc.exe
Size 4.9MB
Sample261003-ktb84acc68
SHA256 4a745392873ad9596f7c4423d66a2f6b1842e3f9dbc7aa1b29089691f365ce73
MD5 84453cfe16d9f5435f3b4225aae64345
SHA1 2ef2d244650195889124ead5a9cdd8c70c089598
SHA512 add4702e3a2b511514a000f7840d1e710a8a5c076ba6e425a52b19952a81dc460ebe69ef0a018556704ac74b7729d87d260f50f69cea1e735121ec3a77adfe94
SSDEEP 98304:M+hBp75lKk0c7WGoqZ92yVG/uzGNV9HkAVHL/DKmFv:M+hBtOkvSByQyVG/uzGNVyAl3K8v
TLSH
T12C36E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
704	powershell.exe
1744	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1684	PeerService.exe
2688	PeerService.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 59 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1560	tasklist.exe
4980	tasklist.exe
2372	tasklist.exe
3040	tasklist.exe
616	tasklist.exe
2652	tasklist.exe
5924	tasklist.exe
1432	tasklist.exe
5604	tasklist.exe
1456	tasklist.exe
4648	tasklist.exe
672	tasklist.exe
120	tasklist.exe
1144	tasklist.exe
4596	tasklist.exe
2864	tasklist.exe
3056	tasklist.exe
568	tasklist.exe
1052	tasklist.exe
1668	tasklist.exe
2532	tasklist.exe
5308	tasklist.exe
3788	tasklist.exe
5060	tasklist.exe
244	tasklist.exe
908	tasklist.exe
1740	tasklist.exe
3320	tasklist.exe
612	tasklist.exe
4432	tasklist.exe
3184	tasklist.exe
4584	tasklist.exe
740	tasklist.exe
616	tasklist.exe
3100	tasklist.exe
3664	tasklist.exe
3448	tasklist.exe
4440	tasklist.exe
5364	tasklist.exe
1316	tasklist.exe
4468	tasklist.exe
5680	tasklist.exe
2416	tasklist.exe
4476	tasklist.exe
4648	tasklist.exe
3544	tasklist.exe
1572	tasklist.exe
3556	tasklist.exe
4548	tasklist.exe
1964	tasklist.exe
1288	tasklist.exe
1688	tasklist.exe
5924	tasklist.exe
3080	tasklist.exe
5416	tasklist.exe
6124	tasklist.exe
2512	tasklist.exe
4316	tasklist.exe
2028	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2344	cmd.exe
2576	cmd.exe
6032	cmd.exe
4536	cmd.exe
5484	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe

Delays execution with timeout.exe 58 IoCs

defense_evasion

pid	Process
4112	timeout.exe
4196	timeout.exe
4708	timeout.exe
352	timeout.exe
4460	timeout.exe
1204	timeout.exe
2460	timeout.exe
988	timeout.exe
3988	timeout.exe
2248	timeout.exe
2208	timeout.exe
2124	timeout.exe
4620	timeout.exe
2204	timeout.exe
920	timeout.exe
3980	timeout.exe
1300	timeout.exe
1740	timeout.exe
1168	timeout.exe
3552	timeout.exe
4508	timeout.exe
4164	timeout.exe
924	timeout.exe
4240	timeout.exe
4488	timeout.exe
760	timeout.exe
4544	timeout.exe
3224	timeout.exe
1460	timeout.exe
5600	timeout.exe
5188	timeout.exe
1972	timeout.exe
1240	timeout.exe
1668	timeout.exe
3980	timeout.exe
6100	timeout.exe
4268	timeout.exe
2248	timeout.exe
1288	timeout.exe
4596	timeout.exe
2408	timeout.exe
3220	timeout.exe
4748	timeout.exe
2564	timeout.exe
1824	timeout.exe
1768	timeout.exe
1744	timeout.exe
4572	timeout.exe
2208	timeout.exe
3356	timeout.exe
4608	timeout.exe
2840	timeout.exe
4952	timeout.exe
2736	timeout.exe
5344	timeout.exe
5612	timeout.exe
4240	timeout.exe
5644	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
704	powershell.exe
704	powershell.exe
704	powershell.exe
1744	powershell.exe
1744	powershell.exe
1744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	704	powershell.exe
Token: SeSecurityPrivilege	704	powershell.exe
Token: SeTakeOwnershipPrivilege	704	powershell.exe
Token: SeLoadDriverPrivilege	704	powershell.exe
Token: SeSystemProfilePrivilege	704	powershell.exe
Token: SeSystemtimePrivilege	704	powershell.exe
Token: SeProfSingleProcessPrivilege	704	powershell.exe
Token: SeIncBasePriorityPrivilege	704	powershell.exe
Token: SeCreatePagefilePrivilege	704	powershell.exe
Token: SeBackupPrivilege	704	powershell.exe
Token: SeRestorePrivilege	704	powershell.exe
Token: SeShutdownPrivilege	704	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeSystemEnvironmentPrivilege	704	powershell.exe
Token: SeRemoteShutdownPrivilege	704	powershell.exe
Token: SeUndockPrivilege	704	powershell.exe
Token: SeManageVolumePrivilege	704	powershell.exe
Token: 33	704	powershell.exe
Token: 34	704	powershell.exe
Token: 35	704	powershell.exe
Token: 36	704	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe
Token: SeDebugPrivilege	3040	tasklist.exe
Token: SeDebugPrivilege	1052	tasklist.exe
Token: SeDebugPrivilege	1456	tasklist.exe
Token: SeDebugPrivilege	3448	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	6124	tasklist.exe
Token: SeDebugPrivilege	3556	tasklist.exe
Token: SeDebugPrivilege	612	tasklist.exe
Token: SeDebugPrivilege	4440	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	4548	tasklist.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	2652	tasklist.exe
Token: SeDebugPrivilege	5364	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	1316	tasklist.exe
Token: SeDebugPrivilege	2028	tasklist.exe
Token: SeDebugPrivilege	1964	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 5484	948	2026-10-02_84453cfe16d9f5435f3b4225aae64345_icedid_njrat_stealc.exe	90
PID 5484 wrote to memory of 5096	5484	cmd.exe	92
PID 948 wrote to memory of 1684	948	2026-10-02_84453cfe16d9f5435f3b4225aae64345_icedid_njrat_stealc.exe	93
PID 1684 wrote to memory of 2576	1684	PeerService.exe	95
PID 1684 wrote to memory of 2344	1684	PeerService.exe	96
PID 2576 wrote to memory of 704	2576	cmd.exe	101
PID 2688 wrote to memory of 4536	2688	PeerService.exe	103
PID 2688 wrote to memory of 6032	2688	PeerService.exe	104
PID 2344 wrote to memory of 5060	2344	cmd.exe	107
PID 2344 wrote to memory of 3344	2344	cmd.exe	108
PID 6032 wrote to memory of 4316	6032	cmd.exe	109
PID 6032 wrote to memory of 2208	6032	cmd.exe	110
PID 4536 wrote to memory of 1744	4536	cmd.exe	111
PID 6032 wrote to memory of 1288	6032	cmd.exe	114
PID 2344 wrote to memory of 1740	2344	cmd.exe	115
PID 6032 wrote to memory of 3040	6032	cmd.exe	116
PID 6032 wrote to memory of 4624	6032	cmd.exe	117
PID 6032 wrote to memory of 920	6032	cmd.exe	118
PID 2344 wrote to memory of 1052	2344	cmd.exe	119
PID 2344 wrote to memory of 2024	2344	cmd.exe	120
PID 2344 wrote to memory of 1824	2344	cmd.exe	121
PID 6032 wrote to memory of 1456	6032	cmd.exe	122
PID 6032 wrote to memory of 1676	6032	cmd.exe	123
PID 6032 wrote to memory of 1972	6032	cmd.exe	124
PID 2344 wrote to memory of 3448	2344	cmd.exe	125
PID 2344 wrote to memory of 2744	2344	cmd.exe	126
PID 2344 wrote to memory of 4708	2344	cmd.exe	127
PID 6032 wrote to memory of 2512	6032	cmd.exe	128
PID 6032 wrote to memory of 5896	6032	cmd.exe	129
PID 6032 wrote to memory of 3980	6032	cmd.exe	130
PID 2344 wrote to memory of 6124	2344	cmd.exe	131
PID 2344 wrote to memory of 2680	2344	cmd.exe	132
PID 2344 wrote to memory of 4240	2344	cmd.exe	133
PID 6032 wrote to memory of 3556	6032	cmd.exe	134
PID 6032 wrote to memory of 2116	6032	cmd.exe	135
PID 6032 wrote to memory of 3220	6032	cmd.exe	136
PID 2344 wrote to memory of 612	2344	cmd.exe	137
PID 2344 wrote to memory of 3636	2344	cmd.exe	138
PID 2344 wrote to memory of 4608	2344	cmd.exe	139
PID 6032 wrote to memory of 4440	6032	cmd.exe	140
PID 6032 wrote to memory of 4540	6032	cmd.exe	141
PID 6032 wrote to memory of 4596	6032	cmd.exe	142
PID 2344 wrote to memory of 4648	2344	cmd.exe	143
PID 2344 wrote to memory of 5592	2344	cmd.exe	144
PID 2344 wrote to memory of 2840	2344	cmd.exe	145
PID 6032 wrote to memory of 4548	6032	cmd.exe	146
PID 6032 wrote to memory of 2460	6032	cmd.exe	147
PID 6032 wrote to memory of 4952	6032	cmd.exe	148
PID 2344 wrote to memory of 1668	2344	cmd.exe	149
PID 2344 wrote to memory of 2932	2344	cmd.exe	150
PID 2344 wrote to memory of 4112	2344	cmd.exe	151
PID 6032 wrote to memory of 2652	6032	cmd.exe	152
PID 6032 wrote to memory of 5012	6032	cmd.exe	153
PID 6032 wrote to memory of 1300	6032	cmd.exe	154
PID 2344 wrote to memory of 5364	2344	cmd.exe	155
PID 2344 wrote to memory of 3816	2344	cmd.exe	156
PID 2344 wrote to memory of 2248	2344	cmd.exe	157
PID 6032 wrote to memory of 1560	6032	cmd.exe	158
PID 6032 wrote to memory of 1796	6032	cmd.exe	159
PID 6032 wrote to memory of 352	6032	cmd.exe	160
PID 2344 wrote to memory of 1316	2344	cmd.exe	161
PID 2344 wrote to memory of 1096	2344	cmd.exe	162
PID 2344 wrote to memory of 1460	2344	cmd.exe	163
PID 6032 wrote to memory of 2028	6032	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-02_84453cfe16d9f5435f3b4225aae64345_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_84453cfe16d9f5435f3b4225aae64345_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:704
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3344
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1052
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1824
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2744
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6124
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:612
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3636
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5592
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1668
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2932
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1964
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:908
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5604
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1768
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:616
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5312
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4596
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3080
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4872
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:668
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1572
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1308
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:120
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3788
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4832
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5192
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3664
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2804
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3568
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5188

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2460
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5012
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1796
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:244
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1712
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1288
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5296
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5924
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5192
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1168
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4468
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4736
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1820
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4268
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5524
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1668
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4848
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5344
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3184
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3344
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2864
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5612
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4584
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4476
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:616
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:612
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5312
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:568
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1xgpqmzy.mxh.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1xgpqmzy.mxh.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.5MB
SHA256 755a33696521c145cf7620bf540779e438a456776b0d0d75df8a6ec50340a3ba
MD5 e7b6ce7f4bfe4f75c6cb87a6a4023ae5
SHA1 f3a11c7f2e21f63d2a727bc48fb0e33159be015d
SHA512 b7a4049874aac9bf077073116e4e52abf9efe36ebf6330e9c7f19ee22f05c70d1f4baca155942f0047fa500015456a1a104c563bb49c05ca81cb0e13bbec0130
SSDEEP 196608:M+hBtOkv2ByQyVG/uzGNVyAl3K8fCGnbP3JzATC0:btOtNSG/lVrl3KExL3JzATh
TLSH
T16266012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-15-0x00000130BE650000-0x00000130BE672000-memory.dmp

Download

memory/704-20-0x00000130D66F0000-0x00000130D670E000-memory.dmp

Download

memory/704-21-0x00000130D6710000-0x00000130D67C2000-memory.dmp

Download

memory/704-22-0x00000130D67D0000-0x00000130D67DA000-memory.dmp

Download