097b314e1a3fc0aa94cc0f1436435972a17fe9b52b2c7b68b57fce5de550f2f2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe
Size 5.7MB
Sample261023-saa6paywat
SHA256 097b314e1a3fc0aa94cc0f1436435972a17fe9b52b2c7b68b57fce5de550f2f2
MD5 16be78d2101802c5e837d5ada1d4966f
SHA1 e13b172fc52031a863f4f75c057c457a43783c51
SHA512 78a1e4acfc1e1f07618c42b6a14cb35d5ba0ebe6dd12dc8e0ed0cc522a4571ae9fbf375148239bff931f642ba9f60be28671f9ddeaf206ff9c40146653ff9f45
SSDEEP 98304:u+hBp75lKkBc9WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWy:u+hBtOkSwByQyVG/uzGNVyAl3K8fCGn+
TLSH
T1C556F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1144	powershell.exe
2356	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
628	PeerService.exe
1128	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4268	tasklist.exe
3976	tasklist.exe
4812	tasklist.exe
1160	tasklist.exe
2844	tasklist.exe
1452	tasklist.exe
1440	tasklist.exe
1692	tasklist.exe
432	tasklist.exe
2568	tasklist.exe
2824	tasklist.exe
1060	tasklist.exe
2004	tasklist.exe
2308	tasklist.exe
4668	tasklist.exe
1340	tasklist.exe
176	tasklist.exe
3320	tasklist.exe
1628	tasklist.exe
3672	tasklist.exe
4304	tasklist.exe
2940	tasklist.exe
2268	tasklist.exe
4064	tasklist.exe
3860	tasklist.exe
3956	tasklist.exe
2144	tasklist.exe
916	tasklist.exe
2732	tasklist.exe
3096	tasklist.exe
2876	tasklist.exe
3012	tasklist.exe
548	tasklist.exe
4944	tasklist.exe
2660	tasklist.exe
4180	tasklist.exe
4652	tasklist.exe
4060	tasklist.exe
1736	tasklist.exe
2804	tasklist.exe
1584	tasklist.exe
1484	tasklist.exe
2332	tasklist.exe
4924	tasklist.exe
4636	tasklist.exe
3808	tasklist.exe
2900	tasklist.exe
4288	tasklist.exe
1440	tasklist.exe
1868	tasklist.exe
4552	tasklist.exe
1000	tasklist.exe
2076	tasklist.exe
4692	tasklist.exe
4196	tasklist.exe
2096	tasklist.exe
772	tasklist.exe
4680	tasklist.exe
3024	tasklist.exe
784	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe
3108	cmd.exe
4556	cmd.exe
4536	cmd.exe
1804	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3980	timeout.exe
2556	timeout.exe
2876	timeout.exe
3304	timeout.exe
3776	timeout.exe
536	timeout.exe
4600	timeout.exe
2876	timeout.exe
4764	timeout.exe
3136	timeout.exe
3520	timeout.exe
3084	timeout.exe
3924	timeout.exe
4020	timeout.exe
3564	timeout.exe
4012	timeout.exe
2456	timeout.exe
3956	timeout.exe
4156	timeout.exe
1752	timeout.exe
4392	timeout.exe
4232	timeout.exe
1076	timeout.exe
2480	timeout.exe
464	timeout.exe
3944	timeout.exe
2096	timeout.exe
2948	timeout.exe
2696	timeout.exe
2496	timeout.exe
2620	timeout.exe
3860	timeout.exe
696	timeout.exe
3504	timeout.exe
4572	timeout.exe
3796	timeout.exe
4404	timeout.exe
4928	timeout.exe
2252	timeout.exe
1768	timeout.exe
4924	timeout.exe
2620	timeout.exe
3788	timeout.exe
4024	timeout.exe
5000	timeout.exe
4404	timeout.exe
376	timeout.exe
4964	timeout.exe
3776	timeout.exe
5112	timeout.exe
1564	timeout.exe
1684	timeout.exe
2904	timeout.exe
464	timeout.exe
1924	timeout.exe
4252	timeout.exe
4252	timeout.exe
3368	timeout.exe
4024	timeout.exe
3376	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2356	powershell.exe
2356	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	tasklist.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	2076	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	2876	tasklist.exe
Token: SeDebugPrivilege	1868	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	3860	tasklist.exe
Token: SeDebugPrivilege	4268	tasklist.exe
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	3672	tasklist.exe
Token: SeDebugPrivilege	1440	tasklist.exe
Token: SeDebugPrivilege	2660	tasklist.exe
Token: SeDebugPrivilege	772	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	1584	tasklist.exe
Token: SeDebugPrivilege	1484	tasklist.exe
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeDebugPrivilege	4180	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	4680	tasklist.exe
Token: SeDebugPrivilege	3012	tasklist.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	3808	tasklist.exe
Token: SeDebugPrivilege	2732	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	432	tasklist.exe
Token: SeDebugPrivilege	2332	tasklist.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	4668	tasklist.exe
Token: SeDebugPrivilege	2568	tasklist.exe
Token: SeDebugPrivilege	2804	tasklist.exe
Token: SeDebugPrivilege	1160	tasklist.exe
Token: SeDebugPrivilege	2844	tasklist.exe
Token: SeDebugPrivilege	4060	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	1340	tasklist.exe
Token: SeDebugPrivilege	4924	tasklist.exe
Token: SeDebugPrivilege	1440	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe
Token: SeDebugPrivilege	3956	tasklist.exe
Token: SeDebugPrivilege	2144	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	784	tasklist.exe
Token: SeDebugPrivilege	4064	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	3096	tasklist.exe
Token: SeDebugPrivilege	4692	tasklist.exe
Token: SeDebugPrivilege	1000	tasklist.exe
Token: SeDebugPrivilege	4636	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe
Token: SeDebugPrivilege	548	tasklist.exe
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	4196	tasklist.exe
Token: SeDebugPrivilege	176	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4344	1640	2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe	86
PID 4344 wrote to memory of 1968	4344	cmd.exe	88
PID 1640 wrote to memory of 628	1640	2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe	89
PID 628 wrote to memory of 4556	628	PeerService.exe	92
PID 628 wrote to memory of 3108	628	PeerService.exe	93
PID 4556 wrote to memory of 2356	4556	cmd.exe	97
PID 3108 wrote to memory of 2004	3108	cmd.exe	98
PID 3108 wrote to memory of 4936	3108	cmd.exe	99
PID 1128 wrote to memory of 1804	1128	PeerService.exe	101
PID 1128 wrote to memory of 4536	1128	PeerService.exe	102
PID 1804 wrote to memory of 1144	1804	cmd.exe	106
PID 4536 wrote to memory of 2076	4536	cmd.exe	107
PID 4536 wrote to memory of 4032	4536	cmd.exe	108
PID 3108 wrote to memory of 3980	3108	cmd.exe	109
PID 4536 wrote to memory of 4392	4536	cmd.exe	110
PID 4536 wrote to memory of 2096	4536	cmd.exe	114
PID 4536 wrote to memory of 1572	4536	cmd.exe	115
PID 3108 wrote to memory of 2876	3108	cmd.exe	116
PID 3108 wrote to memory of 1988	3108	cmd.exe	117
PID 4536 wrote to memory of 3564	4536	cmd.exe	119
PID 3108 wrote to memory of 4232	3108	cmd.exe	120
PID 3108 wrote to memory of 1868	3108	cmd.exe	123
PID 3108 wrote to memory of 3992	3108	cmd.exe	124
PID 4536 wrote to memory of 4944	4536	cmd.exe	125
PID 4536 wrote to memory of 4976	4536	cmd.exe	126
PID 3108 wrote to memory of 464	3108	cmd.exe	127
PID 4536 wrote to memory of 1924	4536	cmd.exe	128
PID 3108 wrote to memory of 3860	3108	cmd.exe	129
PID 3108 wrote to memory of 1776	3108	cmd.exe	130
PID 4536 wrote to memory of 4268	4536	cmd.exe	131
PID 4536 wrote to memory of 916	4536	cmd.exe	132
PID 3108 wrote to memory of 1564	3108	cmd.exe	133
PID 4536 wrote to memory of 4252	4536	cmd.exe	134
PID 3108 wrote to memory of 2308	3108	cmd.exe	135
PID 3108 wrote to memory of 1288	3108	cmd.exe	136
PID 4536 wrote to memory of 3672	4536	cmd.exe	137
PID 4536 wrote to memory of 448	4536	cmd.exe	138
PID 3108 wrote to memory of 4404	3108	cmd.exe	139
PID 4536 wrote to memory of 4012	4536	cmd.exe	140
PID 4536 wrote to memory of 1440	4536	cmd.exe	141
PID 4536 wrote to memory of 2236	4536	cmd.exe	142
PID 3108 wrote to memory of 2660	3108	cmd.exe	143
PID 3108 wrote to memory of 3796	3108	cmd.exe	144
PID 4536 wrote to memory of 2456	4536	cmd.exe	145
PID 3108 wrote to memory of 3956	3108	cmd.exe	146
PID 4536 wrote to memory of 772	4536	cmd.exe	148
PID 4536 wrote to memory of 4348	4536	cmd.exe	149
PID 3108 wrote to memory of 4552	3108	cmd.exe	150
PID 3108 wrote to memory of 696	3108	cmd.exe	151
PID 4536 wrote to memory of 1076	4536	cmd.exe	152
PID 3108 wrote to memory of 3788	3108	cmd.exe	153
PID 3108 wrote to memory of 1584	3108	cmd.exe	155
PID 3108 wrote to memory of 4920	3108	cmd.exe	156
PID 4536 wrote to memory of 1484	4536	cmd.exe	157
PID 4536 wrote to memory of 4484	4536	cmd.exe	158
PID 4536 wrote to memory of 1768	4536	cmd.exe	159
PID 3108 wrote to memory of 2556	3108	cmd.exe	160
PID 4536 wrote to memory of 3976	4536	cmd.exe	161
PID 4536 wrote to memory of 2420	4536	cmd.exe	162
PID 3108 wrote to memory of 4180	3108	cmd.exe	163
PID 3108 wrote to memory of 2028	3108	cmd.exe	164
PID 4536 wrote to memory of 2876	4536	cmd.exe	165
PID 3108 wrote to memory of 4572	3108	cmd.exe	166
PID 3108 wrote to memory of 4288	3108	cmd.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1968
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1868
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3992
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2308
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1288
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4552
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1584
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4920
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4180
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3512
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4060
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3012
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4404
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2496
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:512
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4668
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1908
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2652
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4784
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4512
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:548
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:8
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3136
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3504

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4032
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3564
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4252
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:448
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4348
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4484
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:540
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3608
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3304
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4252
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4156
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4784
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1416
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4484
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:376
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2480
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3128
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2696
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1384
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4404
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5000
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4600
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3944
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4064
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:736
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2096
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1380
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2620
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3376
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1452
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 26fb93195d69045c08c9720cd9291fec8cb24fe49f5dd2604c26d6873f41c3b2
MD5 ffb4808be0aaa918b807bb4dd4f5e080
SHA1 8895ae463a633e1201ed09468acc86e1e57a838b
SHA512 7370e92e6c097ee52ef4d3e3b9ccbf482bbd3603bb25355c84c4c1599c94c8d0d4edc230d7db1ab8dd4d34c40afec839187fa5db46d48c58802e9e3107414ed9
TLSH
T127112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tf4ah2bj.11q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tf4ah2bj.11q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.7MB
SHA256 2bd8c1de7baf5bdd731bb44a22694221271ca836ea4ee0018280810ed5912f16
MD5 3281f5f4f3aa3bb514df31e6c77bbb27
SHA1 41b12935c4e4937178364febc66a0fb48564215e
SHA512 548fce7178e8c9b61b5641d328a808eb5f8c4bc70167e91a6d3c1ffa8dc07ca5143be31c17c886b7608070cafc975a854621fd24517aa29e254352b460334285
SSDEEP 196608:u+hBtOkSwByQyVG/uzGNVyAl3K8fCGnbPOByQyVG/X:htO0NSG/lVrl3KExLqNSG/X
TLSH
T1C866012BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-26-0x0000019E642B0000-0x0000019E642D2000-memory.dmp

Download