dd83201ea2d010f70b32c62f6cf88444ea121f87e4cb64e95be4016c2ebda2ba

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_e4bb570934452e9f93fe6894d13047f6_icedid_njrat_stealc.exe
Size 5.4MB
Sample261014-ly97csbt9j
SHA256 dd83201ea2d010f70b32c62f6cf88444ea121f87e4cb64e95be4016c2ebda2ba
MD5 e4bb570934452e9f93fe6894d13047f6
SHA1 d8cec82b9627ec127502c3e46fb051283b906476
SHA512 838e038271412e2a3a4741df890fef401855f4d3066e5e0367cc1126c56423701934989805365b07814116a76a5a73f0bea6db988fd677f581e29dd1955666d2
SSDEEP 98304:u+hBp75lKkBcIWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4K:u+hBtOkSPByQyVG/uzGNVyAl3K8fCGl
TLSH
T1E246F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2460	powershell.exe
3788	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3992	PeerService.exe
5064	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3392	tasklist.exe
4048	tasklist.exe
4452	tasklist.exe
5792	tasklist.exe
4016	tasklist.exe
4936	tasklist.exe
3816	tasklist.exe
1788	tasklist.exe
4404	tasklist.exe
4852	tasklist.exe
1532	tasklist.exe
4112	tasklist.exe
5404	tasklist.exe
5052	tasklist.exe
4000	tasklist.exe
4388	tasklist.exe
1068	tasklist.exe
3888	tasklist.exe
5528	tasklist.exe
3288	tasklist.exe
4848	tasklist.exe
2824	tasklist.exe
2476	tasklist.exe
4808	tasklist.exe
2696	tasklist.exe
1360	tasklist.exe
2424	tasklist.exe
2464	tasklist.exe
3680	tasklist.exe
1928	tasklist.exe
3572	tasklist.exe
3632	tasklist.exe
1172	tasklist.exe
5716	tasklist.exe
5808	tasklist.exe
4212	tasklist.exe
1500	tasklist.exe
2884	tasklist.exe
5996	tasklist.exe
3280	tasklist.exe
2036	tasklist.exe
5524	tasklist.exe
1912	tasklist.exe
3460	tasklist.exe
4900	tasklist.exe
5788	tasklist.exe
1476	tasklist.exe
976	tasklist.exe
828	tasklist.exe
3760	tasklist.exe
2820	tasklist.exe
2688	tasklist.exe
5112	tasklist.exe
5976	tasklist.exe
1732	tasklist.exe
2928	tasklist.exe
5520	tasklist.exe
4732	tasklist.exe
4536	tasklist.exe
5460	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1240	cmd.exe
1156	cmd.exe
4980	cmd.exe
5892	cmd.exe
3408	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3196	timeout.exe
4560	timeout.exe
4820	timeout.exe
1900	timeout.exe
5056	timeout.exe
2084	timeout.exe
5184	timeout.exe
2724	timeout.exe
1900	timeout.exe
3252	timeout.exe
3636	timeout.exe
4352	timeout.exe
4416	timeout.exe
4772	timeout.exe
1900	timeout.exe
5728	timeout.exe
4328	timeout.exe
2036	timeout.exe
672	timeout.exe
6060	timeout.exe
6104	timeout.exe
1668	timeout.exe
3080	timeout.exe
3912	timeout.exe
5496	timeout.exe
2668	timeout.exe
2056	timeout.exe
2876	timeout.exe
5444	timeout.exe
1516	timeout.exe
4352	timeout.exe
2360	timeout.exe
4640	timeout.exe
1360	timeout.exe
1784	timeout.exe
2724	timeout.exe
3524	timeout.exe
5520	timeout.exe
3196	timeout.exe
3264	timeout.exe
3848	timeout.exe
4848	timeout.exe
5664	timeout.exe
2192	timeout.exe
1820	timeout.exe
720	timeout.exe
2004	timeout.exe
2988	timeout.exe
464	timeout.exe
4900	timeout.exe
2364	timeout.exe
5784	timeout.exe
2476	timeout.exe
5340	timeout.exe
3448	timeout.exe
1920	timeout.exe
2860	timeout.exe
5484	timeout.exe
2620	timeout.exe
5080	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3788	powershell.exe
3788	powershell.exe
2460	powershell.exe
2460	powershell.exe
3788	powershell.exe
2460	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	5716	tasklist.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2460	powershell.exe
Token: SeSecurityPrivilege	2460	powershell.exe
Token: SeTakeOwnershipPrivilege	2460	powershell.exe
Token: SeLoadDriverPrivilege	2460	powershell.exe
Token: SeSystemProfilePrivilege	2460	powershell.exe
Token: SeSystemtimePrivilege	2460	powershell.exe
Token: SeProfSingleProcessPrivilege	2460	powershell.exe
Token: SeIncBasePriorityPrivilege	2460	powershell.exe
Token: SeCreatePagefilePrivilege	2460	powershell.exe
Token: SeBackupPrivilege	2460	powershell.exe
Token: SeRestorePrivilege	2460	powershell.exe
Token: SeShutdownPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeSystemEnvironmentPrivilege	2460	powershell.exe
Token: SeRemoteShutdownPrivilege	2460	powershell.exe
Token: SeUndockPrivilege	2460	powershell.exe
Token: SeManageVolumePrivilege	2460	powershell.exe
Token: 33	2460	powershell.exe
Token: 34	2460	powershell.exe
Token: 35	2460	powershell.exe
Token: 36	2460	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe
Token: SeTakeOwnershipPrivilege	3788	powershell.exe
Token: SeLoadDriverPrivilege	3788	powershell.exe
Token: SeSystemProfilePrivilege	3788	powershell.exe
Token: SeSystemtimePrivilege	3788	powershell.exe
Token: SeProfSingleProcessPrivilege	3788	powershell.exe
Token: SeIncBasePriorityPrivilege	3788	powershell.exe
Token: SeCreatePagefilePrivilege	3788	powershell.exe
Token: SeBackupPrivilege	3788	powershell.exe
Token: SeRestorePrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeSystemEnvironmentPrivilege	3788	powershell.exe
Token: SeRemoteShutdownPrivilege	3788	powershell.exe
Token: SeUndockPrivilege	3788	powershell.exe
Token: SeManageVolumePrivilege	3788	powershell.exe
Token: 33	3788	powershell.exe
Token: 34	3788	powershell.exe
Token: 35	3788	powershell.exe
Token: 36	3788	powershell.exe
Token: SeDebugPrivilege	5808	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	1788	tasklist.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	5976	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	5792	tasklist.exe
Token: SeDebugPrivilege	2696	tasklist.exe
Token: SeDebugPrivilege	1500	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	4016	tasklist.exe
Token: SeDebugPrivilege	1912	tasklist.exe
Token: SeDebugPrivilege	3572	tasklist.exe
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe
Token: SeDebugPrivilege	5996	tasklist.exe
Token: SeDebugPrivilege	4452	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1240	2104	2026-10-14_e4bb570934452e9f93fe6894d13047f6_icedid_njrat_stealc.exe	89
PID 1240 wrote to memory of 4024	1240	cmd.exe	91
PID 2104 wrote to memory of 5064	2104	2026-10-14_e4bb570934452e9f93fe6894d13047f6_icedid_njrat_stealc.exe	94
PID 3992 wrote to memory of 1156	3992	PeerService.exe	96
PID 3992 wrote to memory of 4980	3992	PeerService.exe	97
PID 5064 wrote to memory of 3408	5064	PeerService.exe	100
PID 5064 wrote to memory of 5892	5064	PeerService.exe	101
PID 1156 wrote to memory of 3788	1156	cmd.exe	105
PID 3408 wrote to memory of 2460	3408	cmd.exe	106
PID 5892 wrote to memory of 5716	5892	cmd.exe	107
PID 5892 wrote to memory of 4360	5892	cmd.exe	108
PID 4980 wrote to memory of 4048	4980	cmd.exe	110
PID 4980 wrote to memory of 4420	4980	cmd.exe	111
PID 4980 wrote to memory of 2056	4980	cmd.exe	113
PID 5892 wrote to memory of 464	5892	cmd.exe	114
PID 4980 wrote to memory of 5808	4980	cmd.exe	115
PID 4980 wrote to memory of 5416	4980	cmd.exe	116
PID 5892 wrote to memory of 4808	5892	cmd.exe	117
PID 5892 wrote to memory of 5424	5892	cmd.exe	118
PID 4980 wrote to memory of 4416	4980	cmd.exe	119
PID 5892 wrote to memory of 2724	5892	cmd.exe	120
PID 4980 wrote to memory of 1788	4980	cmd.exe	121
PID 4980 wrote to memory of 200	4980	cmd.exe	122
PID 5892 wrote to memory of 4388	5892	cmd.exe	123
PID 5892 wrote to memory of 1416	5892	cmd.exe	124
PID 4980 wrote to memory of 4772	4980	cmd.exe	125
PID 5892 wrote to memory of 1900	5892	cmd.exe	126
PID 4980 wrote to memory of 5976	4980	cmd.exe	127
PID 4980 wrote to memory of 5672	4980	cmd.exe	128
PID 5892 wrote to memory of 4212	5892	cmd.exe	129
PID 5892 wrote to memory of 5528	5892	cmd.exe	130
PID 4980 wrote to memory of 4560	4980	cmd.exe	131
PID 5892 wrote to memory of 5484	5892	cmd.exe	132
PID 4980 wrote to memory of 5792	4980	cmd.exe	133
PID 4980 wrote to memory of 1256	4980	cmd.exe	134
PID 5892 wrote to memory of 2696	5892	cmd.exe	135
PID 5892 wrote to memory of 5768	5892	cmd.exe	136
PID 4980 wrote to memory of 4900	4980	cmd.exe	137
PID 5892 wrote to memory of 1516	5892	cmd.exe	138
PID 5892 wrote to memory of 1500	5892	cmd.exe	139
PID 5892 wrote to memory of 4532	5892	cmd.exe	140
PID 4980 wrote to memory of 5524	4980	cmd.exe	141
PID 4980 wrote to memory of 428	4980	cmd.exe	142
PID 5892 wrote to memory of 4820	5892	cmd.exe	143
PID 4980 wrote to memory of 4640	4980	cmd.exe	144
PID 4980 wrote to memory of 4016	4980	cmd.exe	146
PID 4980 wrote to memory of 260	4980	cmd.exe	147
PID 5892 wrote to memory of 1912	5892	cmd.exe	148
PID 5892 wrote to memory of 4488	5892	cmd.exe	149
PID 4980 wrote to memory of 3848	4980	cmd.exe	150
PID 5892 wrote to memory of 1668	5892	cmd.exe	151
PID 4980 wrote to memory of 3572	4980	cmd.exe	152
PID 4980 wrote to memory of 3236	4980	cmd.exe	153
PID 5892 wrote to memory of 2884	5892	cmd.exe	154
PID 5892 wrote to memory of 1948	5892	cmd.exe	155
PID 4980 wrote to memory of 4848	4980	cmd.exe	156
PID 5892 wrote to memory of 5728	5892	cmd.exe	157
PID 4980 wrote to memory of 976	4980	cmd.exe	158
PID 4980 wrote to memory of 548	4980	cmd.exe	159
PID 5892 wrote to memory of 1360	5892	cmd.exe	160
PID 5892 wrote to memory of 4572	5892	cmd.exe	161
PID 4980 wrote to memory of 5496	4980	cmd.exe	162
PID 5892 wrote to memory of 4328	5892	cmd.exe	163
PID 4980 wrote to memory of 5996	4980	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-14_e4bb570934452e9f93fe6894d13047f6_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_e4bb570934452e9f93fe6894d13047f6_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4024
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2460
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5716
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4360
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5424
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1500
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4532
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2928
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3784
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3280
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2956
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3680
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1060
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3888
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4620
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4852
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1668
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3636
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4848
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5872
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2688
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4744
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1476
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4144
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1928
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4456
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2476
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5736
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3508
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5520

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4772
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4560
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1256
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3848
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4848
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:548
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2484
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4936
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1068
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1920
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3816
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2344
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4900
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1632
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5520
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2820
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4032
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5788
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6076
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4912
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5460
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3196
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2464
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1076
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2036
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3912
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3392
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc3adc6f82a8110a928ed6755b7c363f1af83ceb434f5587e2511e4f6cdf9e42
MD5 80642800e302d25cc033771c919d3151
SHA1 8e0f876702ebf5c019a9aaad2aab944546d0f2e7
SHA512 77075167b3f0877d2a41ed3bdb3482a8d1c187c11351b16737d4811047bdab9237af563d5450ae2f6c5d37472f7ff3346fc0bba99cebb9d08a906bdb4f6e88b4
TLSH
T1E6216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bdv24fgs.cuf.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdv24fgs.cuf.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 4.9MB
SHA256 2bf79846aa7c59d002c22ca0c3a7bd1ae30c30368cb8b268a0e8530c3394c951
MD5 fe3823e6602e7e1f65878c51f6dc2017
SHA1 93cf1aeeeeb52249681b8ababc06ee473e0c2579
SHA512 5eddcba3f5736d5ee76b650ff32dcbb66a73a239ff10affbd0cf104aacaff20aaddba6ba6a5c1ecbd985ec639e4d9cb0875c60bbe11c752d44af77276f10602b
SSDEEP 98304:u+hBp75lKkBc6WGoqZ92yVG/uzGNV9HkAVHL/DKmFr:u+hBtOkSNByQyVG/uzGNVyAl3K8r
TLSH
T1C336E12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3788-15-0x000001F99C9F0000-0x000001F99CA12000-memory.dmp

Download

memory/3788-20-0x000001F9B5220000-0x000001F9B523E000-memory.dmp

Download

memory/3788-21-0x000001F9B5240000-0x000001F9B52F2000-memory.dmp

Download

memory/3788-24-0x000001F9B5210000-0x000001F9B521A000-memory.dmp

Download