097b314e1a3fc0aa94cc0f1436435972a17fe9b52b2c7b68b57fce5de550f2f2

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe
Size 5.7MB
Sample261023-saa6paywat
SHA256 097b314e1a3fc0aa94cc0f1436435972a17fe9b52b2c7b68b57fce5de550f2f2
MD5 16be78d2101802c5e837d5ada1d4966f
SHA1 e13b172fc52031a863f4f75c057c457a43783c51
SHA512 78a1e4acfc1e1f07618c42b6a14cb35d5ba0ebe6dd12dc8e0ed0cc522a4571ae9fbf375148239bff931f642ba9f60be28671f9ddeaf206ff9c40146653ff9f45
SSDEEP 98304:u+hBp75lKkBc9WGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWy:u+hBtOkSwByQyVG/uzGNVyAl3K8fCGn+
TLSH
T1C556F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5036	powershell.exe
6096	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4664	PeerService.exe
5984	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5436	tasklist.exe
3724	tasklist.exe
2204	tasklist.exe
5332	tasklist.exe
4124	tasklist.exe
1900	tasklist.exe
2388	tasklist.exe
4388	tasklist.exe
4176	tasklist.exe
5240	tasklist.exe
4328	tasklist.exe
1496	tasklist.exe
4368	tasklist.exe
4852	tasklist.exe
6008	tasklist.exe
4376	tasklist.exe
812	tasklist.exe
4012	tasklist.exe
6112	tasklist.exe
6132	tasklist.exe
4404	tasklist.exe
3024	tasklist.exe
1852	tasklist.exe
1516	tasklist.exe
3996	tasklist.exe
6040	tasklist.exe
5376	tasklist.exe
632	tasklist.exe
4768	tasklist.exe
1156	tasklist.exe
5764	tasklist.exe
1268	tasklist.exe
3996	tasklist.exe
4316	tasklist.exe
2968	tasklist.exe
2564	tasklist.exe
5808	tasklist.exe
2544	tasklist.exe
632	tasklist.exe
5740	tasklist.exe
3848	tasklist.exe
1036	tasklist.exe
2508	tasklist.exe
3892	tasklist.exe
3180	tasklist.exe
5872	tasklist.exe
5952	tasklist.exe
3956	tasklist.exe
4924	tasklist.exe
912	tasklist.exe
1772	tasklist.exe
2528	tasklist.exe
2412	tasklist.exe
4648	tasklist.exe
5864	tasklist.exe
4508	tasklist.exe
4764	tasklist.exe
2808	tasklist.exe
2888	tasklist.exe
3876	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6000	cmd.exe
5160	cmd.exe
4592	cmd.exe
2816	cmd.exe
4356	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
5452	timeout.exe
2580	timeout.exe
3128	timeout.exe
5996	timeout.exe
3172	timeout.exe
5256	timeout.exe
1172	timeout.exe
588	timeout.exe
2832	timeout.exe
5872	timeout.exe
5052	timeout.exe
4968	timeout.exe
3220	timeout.exe
4440	timeout.exe
2932	timeout.exe
5784	timeout.exe
1876	timeout.exe
3220	timeout.exe
1956	timeout.exe
5004	timeout.exe
3628	timeout.exe
1904	timeout.exe
5608	timeout.exe
4008	timeout.exe
1900	timeout.exe
5400	timeout.exe
2352	timeout.exe
1824	timeout.exe
3464	timeout.exe
2528	timeout.exe
5072	timeout.exe
1104	timeout.exe
4616	timeout.exe
5692	timeout.exe
4724	timeout.exe
5840	timeout.exe
2916	timeout.exe
896	timeout.exe
2236	timeout.exe
3892	timeout.exe
3996	timeout.exe
2860	timeout.exe
2776	timeout.exe
4488	timeout.exe
4304	timeout.exe
4852	timeout.exe
5568	timeout.exe
2296	timeout.exe
1852	timeout.exe
6092	timeout.exe
4600	timeout.exe
4224	timeout.exe
1036	timeout.exe
4288	timeout.exe
5764	timeout.exe
5180	timeout.exe
3012	timeout.exe
6124	timeout.exe
4284	timeout.exe
2444	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	3996	tasklist.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	6096	powershell.exe
Token: SeSecurityPrivilege	6096	powershell.exe
Token: SeTakeOwnershipPrivilege	6096	powershell.exe
Token: SeLoadDriverPrivilege	6096	powershell.exe
Token: SeSystemProfilePrivilege	6096	powershell.exe
Token: SeSystemtimePrivilege	6096	powershell.exe
Token: SeProfSingleProcessPrivilege	6096	powershell.exe
Token: SeIncBasePriorityPrivilege	6096	powershell.exe
Token: SeCreatePagefilePrivilege	6096	powershell.exe
Token: SeBackupPrivilege	6096	powershell.exe
Token: SeRestorePrivilege	6096	powershell.exe
Token: SeShutdownPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeSystemEnvironmentPrivilege	6096	powershell.exe
Token: SeRemoteShutdownPrivilege	6096	powershell.exe
Token: SeUndockPrivilege	6096	powershell.exe
Token: SeManageVolumePrivilege	6096	powershell.exe
Token: 33	6096	powershell.exe
Token: 34	6096	powershell.exe
Token: 35	6096	powershell.exe
Token: 36	6096	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe
Token: 33	5036	powershell.exe
Token: 34	5036	powershell.exe
Token: 35	5036	powershell.exe
Token: 36	5036	powershell.exe
Token: SeDebugPrivilege	632	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	4768	tasklist.exe
Token: SeDebugPrivilege	5808	tasklist.exe
Token: SeDebugPrivilege	1036	tasklist.exe
Token: SeDebugPrivilege	2544	tasklist.exe
Token: SeDebugPrivilege	2508	tasklist.exe
Token: SeDebugPrivilege	3724	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	3892	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	1156	tasklist.exe
Token: SeDebugPrivilege	5240	tasklist.exe
Token: SeDebugPrivilege	6008	tasklist.exe
Token: SeDebugPrivilege	3180	tasklist.exe
Token: SeDebugPrivilege	5764	tasklist.exe
Token: SeDebugPrivilege	5864	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 6000	5424	2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe	89
PID 6000 wrote to memory of 4120	6000	cmd.exe	91
PID 5424 wrote to memory of 4664	5424	2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe	93
PID 5984 wrote to memory of 5160	5984	PeerService.exe	96
PID 5984 wrote to memory of 4592	5984	PeerService.exe	97
PID 4664 wrote to memory of 4356	4664	PeerService.exe	101
PID 4664 wrote to memory of 2816	4664	PeerService.exe	102
PID 5160 wrote to memory of 5036	5160	cmd.exe	105
PID 4592 wrote to memory of 4388	4592	cmd.exe	106
PID 4592 wrote to memory of 2564	4592	cmd.exe	107
PID 4356 wrote to memory of 6096	4356	cmd.exe	108
PID 2816 wrote to memory of 3996	2816	cmd.exe	109
PID 2816 wrote to memory of 2396	2816	cmd.exe	110
PID 2816 wrote to memory of 5180	2816	cmd.exe	113
PID 4592 wrote to memory of 4304	4592	cmd.exe	114
PID 4592 wrote to memory of 632	4592	cmd.exe	115
PID 4592 wrote to memory of 6040	4592	cmd.exe	116
PID 2816 wrote to memory of 4316	2816	cmd.exe	117
PID 2816 wrote to memory of 2624	2816	cmd.exe	118
PID 4592 wrote to memory of 3220	4592	cmd.exe	119
PID 2816 wrote to memory of 4724	2816	cmd.exe	120
PID 2816 wrote to memory of 4852	2816	cmd.exe	121
PID 2816 wrote to memory of 3376	2816	cmd.exe	122
PID 4592 wrote to memory of 4768	4592	cmd.exe	123
PID 4592 wrote to memory of 4404	4592	cmd.exe	124
PID 2816 wrote to memory of 3012	2816	cmd.exe	125
PID 4592 wrote to memory of 2528	4592	cmd.exe	126
PID 2816 wrote to memory of 5808	2816	cmd.exe	127
PID 2816 wrote to memory of 4348	2816	cmd.exe	128
PID 4592 wrote to memory of 1036	4592	cmd.exe	129
PID 4592 wrote to memory of 1092	4592	cmd.exe	130
PID 2816 wrote to memory of 4440	2816	cmd.exe	131
PID 4592 wrote to memory of 5840	4592	cmd.exe	132
PID 4592 wrote to memory of 2544	4592	cmd.exe	133
PID 4592 wrote to memory of 4736	4592	cmd.exe	134
PID 2816 wrote to memory of 2508	2816	cmd.exe	135
PID 2816 wrote to memory of 6112	2816	cmd.exe	136
PID 4592 wrote to memory of 4008	4592	cmd.exe	137
PID 2816 wrote to memory of 2236	2816	cmd.exe	138
PID 2816 wrote to memory of 3724	2816	cmd.exe	139
PID 2816 wrote to memory of 4328	2816	cmd.exe	140
PID 4592 wrote to memory of 4648	4592	cmd.exe	141
PID 4592 wrote to memory of 2800	4592	cmd.exe	142
PID 2816 wrote to memory of 4968	2816	cmd.exe	143
PID 4592 wrote to memory of 5004	4592	cmd.exe	144
PID 4592 wrote to memory of 3892	4592	cmd.exe	146
PID 4592 wrote to memory of 2976	4592	cmd.exe	147
PID 2816 wrote to memory of 3024	2816	cmd.exe	148
PID 2816 wrote to memory of 2708	2816	cmd.exe	149
PID 4592 wrote to memory of 1852	4592	cmd.exe	150
PID 2816 wrote to memory of 5072	2816	cmd.exe	151
PID 4592 wrote to memory of 1156	4592	cmd.exe	152
PID 4592 wrote to memory of 4556	4592	cmd.exe	153
PID 2816 wrote to memory of 5240	2816	cmd.exe	154
PID 2816 wrote to memory of 2648	2816	cmd.exe	155
PID 4592 wrote to memory of 5452	4592	cmd.exe	156
PID 2816 wrote to memory of 2444	2816	cmd.exe	157
PID 2816 wrote to memory of 6008	2816	cmd.exe	158
PID 2816 wrote to memory of 1800	2816	cmd.exe	159
PID 4592 wrote to memory of 3180	4592	cmd.exe	160
PID 4592 wrote to memory of 2288	4592	cmd.exe	161
PID 2816 wrote to memory of 3628	2816	cmd.exe	162
PID 4592 wrote to memory of 1904	4592	cmd.exe	163
PID 4592 wrote to memory of 5764	4592	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_16be78d2101802c5e837d5ada1d4966f_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2624
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4852
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3376
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4348
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2508
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3724
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2648
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6008
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1800
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5864
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:632
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4404
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4012
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3152
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4764
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1852
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2888
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4288
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2968
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1084
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1824
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2564
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1268
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2528
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5436
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1516
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2428
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3956
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5804
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4336
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3848
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4488

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4304
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4404
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2528
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1092
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5840
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4736
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2288
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1904
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2984
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6092
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4924
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5264
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4508
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3208
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:588
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2568
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4204
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5996
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5740
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5352
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5400
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4284
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4124
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4280
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3892
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2388
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:912
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4704
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3876
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1356
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6040
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1076
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6016
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:812
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3780
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4012
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5784
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4368
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1956
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5376
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3624
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2412
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_surbhsm0.uqu.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_surbhsm0.uqu.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 3.9MB
SHA256 7eb5a066a9ca51f4ef3e9d0709a25b0d58dcf768478bca5674ff68eb2e2c2f51
MD5 8c15a5ec37955b4a17217e4aa40ad2b3
SHA1 faf6b3266182d7449a8d7005372146be5f411409
SHA512 b9c291437353fff3158e18aecb285a760404d381e10458a1a8bb3ef6b7b8e58486bdefe914477fa4d5c1a474260bfde2f1e6e34a04d43af805d69d71d87832ce
SSDEEP 98304:u+hBp75lKkBcaWGoqZ92yVG/uzGNV9Hk6:u+hBtOkStByQyVG/uzGNVy6
TLSH
T16C16D02BB26901E8D1BFD17CC9165907EBB2780503A0A7DF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5036-15-0x000002B92BD80000-0x000002B92BDA2000-memory.dmp

Download

memory/5036-20-0x000002B92BE40000-0x000002B92BE5E000-memory.dmp

Download

memory/5036-21-0x000002B92BF70000-0x000002B92C022000-memory.dmp

Download

memory/5036-24-0x000002B92BE20000-0x000002B92BE2A000-memory.dmp

Download