72f76c62a2ccf0075fd152ad26ec532a0e4a1a8f831f7f1b853a49ca100d287b

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe
Size 3.6MB
Sample261027-q46hksdw21
SHA256 72f76c62a2ccf0075fd152ad26ec532a0e4a1a8f831f7f1b853a49ca100d287b
MD5 7c3081bafdbf567251a9fd7d8d986fba
SHA1 74740ab9c5dc4d20d3980357ee60096e92289ba6
SHA512 19ac2d0d6b8b2708b7cee761dc0b8d10f60eb2df63fd433982638704d23e8fbb4751cc1f743c979cf7ff11fc38e278ae6ad2bb927fa5424946a6d77148559f55
SSDEEP 49152:u++MB9P91XphIl8pF58HsKkZrXvCHLvQu2XG8ZoI9Z9rqyI44HppuzGxHHY4LA:u+hBp75lKkBcwWGoqZ92yVG/uzGNVM
TLSH
T19806D02BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1844	powershell.exe
712	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3028	PeerService.exe
4252	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4832	tasklist.exe
1256	tasklist.exe
3528	tasklist.exe
1676	tasklist.exe
1680	tasklist.exe
4796	tasklist.exe
2920	tasklist.exe
4524	tasklist.exe
2296	tasklist.exe
2772	tasklist.exe
2576	tasklist.exe
4952	tasklist.exe
2392	tasklist.exe
1880	tasklist.exe
4940	tasklist.exe
5648	tasklist.exe
6048	tasklist.exe
1732	tasklist.exe
3452	tasklist.exe
6040	tasklist.exe
6036	tasklist.exe
4300	tasklist.exe
2828	tasklist.exe
3876	tasklist.exe
1040	tasklist.exe
5700	tasklist.exe
4368	tasklist.exe
4256	tasklist.exe
760	tasklist.exe
3628	tasklist.exe
4292	tasklist.exe
1764	tasklist.exe
5904	tasklist.exe
2836	tasklist.exe
1760	tasklist.exe
3684	tasklist.exe
5504	tasklist.exe
3960	tasklist.exe
3524	tasklist.exe
3244	tasklist.exe
1764	tasklist.exe
236	tasklist.exe
2660	tasklist.exe
4088	tasklist.exe
1736	tasklist.exe
4720	tasklist.exe
4336	tasklist.exe
2176	tasklist.exe
1824	tasklist.exe
1344	tasklist.exe
6040	tasklist.exe
2448	tasklist.exe
4192	tasklist.exe
5732	tasklist.exe
5076	tasklist.exe
452	tasklist.exe
496	tasklist.exe
1680	tasklist.exe
4580	tasklist.exe
3012	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6004	cmd.exe
4108	cmd.exe
5292	cmd.exe
3844	cmd.exe
2600	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3468	timeout.exe
4980	timeout.exe
5648	timeout.exe
3412	timeout.exe
6068	timeout.exe
2760	timeout.exe
1140	timeout.exe
4156	timeout.exe
124	timeout.exe
464	timeout.exe
3296	timeout.exe
5028	timeout.exe
5948	timeout.exe
1632	timeout.exe
5764	timeout.exe
1660	timeout.exe
700	timeout.exe
5144	timeout.exe
5948	timeout.exe
1116	timeout.exe
4244	timeout.exe
4668	timeout.exe
5580	timeout.exe
4528	timeout.exe
3532	timeout.exe
1988	timeout.exe
1260	timeout.exe
460	timeout.exe
2528	timeout.exe
1552	timeout.exe
4936	timeout.exe
4980	timeout.exe
3132	timeout.exe
5864	timeout.exe
2016	timeout.exe
1872	timeout.exe
3124	timeout.exe
1272	timeout.exe
120	timeout.exe
4192	timeout.exe
1088	timeout.exe
5316	timeout.exe
560	timeout.exe
5368	timeout.exe
4220	timeout.exe
612	timeout.exe
4124	timeout.exe
2436	timeout.exe
2728	timeout.exe
1492	timeout.exe
3112	timeout.exe
6140	timeout.exe
1868	timeout.exe
1356	timeout.exe
1760	timeout.exe
5500	timeout.exe
1612	timeout.exe
4464	timeout.exe
4404	timeout.exe
5952	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
712	powershell.exe
712	powershell.exe
1844	powershell.exe
712	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeDebugPrivilege	1760	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1844	powershell.exe
Token: SeSecurityPrivilege	1844	powershell.exe
Token: SeTakeOwnershipPrivilege	1844	powershell.exe
Token: SeLoadDriverPrivilege	1844	powershell.exe
Token: SeSystemProfilePrivilege	1844	powershell.exe
Token: SeSystemtimePrivilege	1844	powershell.exe
Token: SeProfSingleProcessPrivilege	1844	powershell.exe
Token: SeIncBasePriorityPrivilege	1844	powershell.exe
Token: SeCreatePagefilePrivilege	1844	powershell.exe
Token: SeBackupPrivilege	1844	powershell.exe
Token: SeRestorePrivilege	1844	powershell.exe
Token: SeShutdownPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeSystemEnvironmentPrivilege	1844	powershell.exe
Token: SeRemoteShutdownPrivilege	1844	powershell.exe
Token: SeUndockPrivilege	1844	powershell.exe
Token: SeManageVolumePrivilege	1844	powershell.exe
Token: 33	1844	powershell.exe
Token: 34	1844	powershell.exe
Token: 35	1844	powershell.exe
Token: 36	1844	powershell.exe
Token: SeIncreaseQuotaPrivilege	712	powershell.exe
Token: SeSecurityPrivilege	712	powershell.exe
Token: SeTakeOwnershipPrivilege	712	powershell.exe
Token: SeLoadDriverPrivilege	712	powershell.exe
Token: SeSystemProfilePrivilege	712	powershell.exe
Token: SeSystemtimePrivilege	712	powershell.exe
Token: SeProfSingleProcessPrivilege	712	powershell.exe
Token: SeIncBasePriorityPrivilege	712	powershell.exe
Token: SeCreatePagefilePrivilege	712	powershell.exe
Token: SeBackupPrivilege	712	powershell.exe
Token: SeRestorePrivilege	712	powershell.exe
Token: SeShutdownPrivilege	712	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeSystemEnvironmentPrivilege	712	powershell.exe
Token: SeRemoteShutdownPrivilege	712	powershell.exe
Token: SeUndockPrivilege	712	powershell.exe
Token: SeManageVolumePrivilege	712	powershell.exe
Token: 33	712	powershell.exe
Token: 34	712	powershell.exe
Token: 35	712	powershell.exe
Token: 36	712	powershell.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	3684	tasklist.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	6040	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	5700	tasklist.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	4368	tasklist.exe
Token: SeDebugPrivilege	496	tasklist.exe
Token: SeDebugPrivilege	4336	tasklist.exe
Token: SeDebugPrivilege	1764	tasklist.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	4256	tasklist.exe
Token: SeDebugPrivilege	1732	tasklist.exe
Token: SeDebugPrivilege	5504	tasklist.exe
Token: SeDebugPrivilege	4940	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	4796	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 5292	5228	2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe	90
PID 5292 wrote to memory of 2660	5292	cmd.exe	92
PID 5228 wrote to memory of 3028	5228	2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe	93
PID 3028 wrote to memory of 2600	3028	PeerService.exe	96
PID 3028 wrote to memory of 3844	3028	PeerService.exe	97
PID 4252 wrote to memory of 4108	4252	PeerService.exe	101
PID 4252 wrote to memory of 6004	4252	PeerService.exe	102
PID 4108 wrote to memory of 1844	4108	cmd.exe	106
PID 6004 wrote to memory of 2836	6004	cmd.exe	107
PID 6004 wrote to memory of 3748	6004	cmd.exe	108
PID 2600 wrote to memory of 712	2600	cmd.exe	109
PID 3844 wrote to memory of 1760	3844	cmd.exe	111
PID 3844 wrote to memory of 2812	3844	cmd.exe	112
PID 6004 wrote to memory of 3296	6004	cmd.exe	114
PID 3844 wrote to memory of 1552	3844	cmd.exe	115
PID 3844 wrote to memory of 3244	3844	cmd.exe	116
PID 3844 wrote to memory of 2584	3844	cmd.exe	117
PID 6004 wrote to memory of 3684	6004	cmd.exe	118
PID 6004 wrote to memory of 3532	6004	cmd.exe	119
PID 3844 wrote to memory of 4980	3844	cmd.exe	120
PID 6004 wrote to memory of 5144	6004	cmd.exe	121
PID 3844 wrote to memory of 1040	3844	cmd.exe	122
PID 3844 wrote to memory of 4192	3844	cmd.exe	123
PID 6004 wrote to memory of 6040	6004	cmd.exe	124
PID 6004 wrote to memory of 2260	6004	cmd.exe	125
PID 3844 wrote to memory of 5864	3844	cmd.exe	126
PID 6004 wrote to memory of 5948	6004	cmd.exe	127
PID 3844 wrote to memory of 4832	3844	cmd.exe	128
PID 3844 wrote to memory of 5028	3844	cmd.exe	129
PID 6004 wrote to memory of 5700	6004	cmd.exe	130
PID 6004 wrote to memory of 2512	6004	cmd.exe	131
PID 3844 wrote to memory of 4936	3844	cmd.exe	132
PID 6004 wrote to memory of 1116	6004	cmd.exe	133
PID 3844 wrote to memory of 2296	3844	cmd.exe	134
PID 3844 wrote to memory of 5940	3844	cmd.exe	135
PID 6004 wrote to memory of 4368	6004	cmd.exe	136
PID 6004 wrote to memory of 1492	6004	cmd.exe	137
PID 3844 wrote to memory of 5316	3844	cmd.exe	138
PID 6004 wrote to memory of 6140	6004	cmd.exe	139
PID 3844 wrote to memory of 496	3844	cmd.exe	140
PID 3844 wrote to memory of 4672	3844	cmd.exe	141
PID 6004 wrote to memory of 4336	6004	cmd.exe	142
PID 6004 wrote to memory of 1068	6004	cmd.exe	143
PID 3844 wrote to memory of 1612	3844	cmd.exe	144
PID 6004 wrote to memory of 2436	6004	cmd.exe	145
PID 3844 wrote to memory of 1764	3844	cmd.exe	147
PID 6004 wrote to memory of 2772	6004	cmd.exe	148
PID 3844 wrote to memory of 4552	3844	cmd.exe	149
PID 6004 wrote to memory of 1120	6004	cmd.exe	150
PID 3844 wrote to memory of 560	3844	cmd.exe	151
PID 6004 wrote to memory of 4244	6004	cmd.exe	152
PID 6004 wrote to memory of 4256	6004	cmd.exe	153
PID 6004 wrote to memory of 6060	6004	cmd.exe	154
PID 3844 wrote to memory of 1732	3844	cmd.exe	155
PID 3844 wrote to memory of 3972	3844	cmd.exe	156
PID 6004 wrote to memory of 2728	6004	cmd.exe	157
PID 3844 wrote to memory of 2016	3844	cmd.exe	158
PID 6004 wrote to memory of 5504	6004	cmd.exe	159
PID 6004 wrote to memory of 5636	6004	cmd.exe	160
PID 3844 wrote to memory of 4940	3844	cmd.exe	161
PID 3844 wrote to memory of 5056	3844	cmd.exe	162
PID 3844 wrote to memory of 5648	3844	cmd.exe	163
PID 6004 wrote to memory of 1868	6004	cmd.exe	164
PID 6004 wrote to memory of 2576	6004	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7c3081bafdbf567251a9fd7d8d986fba_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5292
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2660
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2812
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2584
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4192
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5864
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2296
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4672
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1732
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3972
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5056
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1760
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4292
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1680
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5176
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4952
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2776
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:236
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4580
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:6140
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2664
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2940
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4156
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4084
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1676
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4372
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3012
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2612
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2816
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4088
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6036
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1344
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5044
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3124
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5548
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4300
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1988

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5144
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6040
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2512
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6060
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2728
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1868
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3296
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6068
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1412
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2392
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2296
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2660
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4516
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3124
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2176
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3528
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2344
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1824
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:516
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5896
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1680
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:124
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4192
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4780
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4276
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:460
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:6048
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4532
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4120
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2528
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:452
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3876
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_g1gbze4m.szt.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1gbze4m.szt.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 3.6MB
SHA256 fb569ba5ce55dc401e47299ab936351ba335b1a5cba9cdb6b14aedcb6c159d80
MD5 ceeed94ca59eaa7b61fa2ee9285bea9b
SHA1 0f3a63fae129229c990927eb083ac7da6f8c2367
SHA512 7ac70688bc322f5ff94febeec25099b1e13b8dd4bbff193225cd7c263349180542e0f603b0326c146b309397a73ebfb37f3b79b7eca91269f63449846f1b8953
SSDEEP 49152:u++MB9P91XphIl8pF58HsKkZrXvCHLLQu2XG8ZoI9Z9rqyI44HppuzGxHHY4La:u+hBp75lKkBcUWGoqZ92yVG/uzGNVe
TLSH
T16206D02BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-15-0x00000209F7AD0000-0x00000209F7AF2000-memory.dmp

Download

memory/1844-20-0x00000209F7DA0000-0x00000209F7DBE000-memory.dmp

Download

memory/1844-21-0x00000209F7DC0000-0x00000209F7E72000-memory.dmp

Download

memory/1844-24-0x00000209F7E80000-0x00000209F7E8A000-memory.dmp

Download