2aec538f7870f2fa10a108fe4210a165bf18f924039ce6a3ac89e4686bdf7ebe

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_53b557cf5b8b69112287e4987d342b3b_icedid_njrat_stealc.exe
Size 3.1MB
Sample261027-vxbf3stt5k
SHA256 2aec538f7870f2fa10a108fe4210a165bf18f924039ce6a3ac89e4686bdf7ebe
MD5 53b557cf5b8b69112287e4987d342b3b
SHA1 f381fc57119572a554da1fce5c3c959985fe0ee9
SHA512 858b06e718cfb6205f6e987cbcabc2a4d41c3e25775dbfc5f200589c7d09eb749c27f0a90465a18fb6dc13bb0e5eac6a0664205197e917deed7de35e915cfdf2
SSDEEP 49152:u++MB9P91XphIl8pF58HsKkZrXvCHLiQu2XG8ZoI9Z9rqyI44Hpp5:u+hBp75lKkBcBWGoqZ92yVG/5
TLSH
T177E5BF2BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1340	powershell.exe
4760	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
960	PeerService.exe
3664	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5192	tasklist.exe
1484	tasklist.exe
4776	tasklist.exe
5952	tasklist.exe
2764	tasklist.exe
1896	tasklist.exe
2072	tasklist.exe
1316	tasklist.exe
2772	tasklist.exe
4424	tasklist.exe
3272	tasklist.exe
256	tasklist.exe
5288	tasklist.exe
4960	tasklist.exe
2984	tasklist.exe
1600	tasklist.exe
5340	tasklist.exe
5460	tasklist.exe
4932	tasklist.exe
4444	tasklist.exe
2384	tasklist.exe
2464	tasklist.exe
3116	tasklist.exe
2792	tasklist.exe
1820	tasklist.exe
3996	tasklist.exe
5004	tasklist.exe
3252	tasklist.exe
5856	tasklist.exe
4372	tasklist.exe
5028	tasklist.exe
5264	tasklist.exe
1532	tasklist.exe
4996	tasklist.exe
1460	tasklist.exe
4112	tasklist.exe
5816	tasklist.exe
3536	tasklist.exe
5316	tasklist.exe
2388	tasklist.exe
6040	tasklist.exe
3644	tasklist.exe
2612	tasklist.exe
5876	tasklist.exe
5884	tasklist.exe
4364	tasklist.exe
5116	tasklist.exe
5128	tasklist.exe
1660	tasklist.exe
600	tasklist.exe
5272	tasklist.exe
3500	tasklist.exe
3372	tasklist.exe
2428	tasklist.exe
1964	tasklist.exe
4140	tasklist.exe
3136	tasklist.exe
4232	tasklist.exe
4132	tasklist.exe
5864	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1956	cmd.exe
940	cmd.exe
6140	cmd.exe
4716	cmd.exe
1792	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 59 IoCs

defense_evasion

pid	Process
4764	timeout.exe
5640	timeout.exe
5212	timeout.exe
5640	timeout.exe
5300	timeout.exe
4304	timeout.exe
5128	timeout.exe
4180	timeout.exe
3508	timeout.exe
3408	timeout.exe
3392	timeout.exe
5924	timeout.exe
2980	timeout.exe
3456	timeout.exe
3504	timeout.exe
3392	timeout.exe
5340	timeout.exe
4444	timeout.exe
2952	timeout.exe
1964	timeout.exe
936	timeout.exe
2364	timeout.exe
4568	timeout.exe
5608	timeout.exe
5604	timeout.exe
3948	timeout.exe
2772	timeout.exe
1076	timeout.exe
1088	timeout.exe
5884	timeout.exe
2532	timeout.exe
5064	timeout.exe
2656	timeout.exe
4948	timeout.exe
1744	timeout.exe
1116	timeout.exe
5652	timeout.exe
3272	timeout.exe
3740	timeout.exe
4452	timeout.exe
1736	timeout.exe
1132	timeout.exe
2360	timeout.exe
5848	timeout.exe
1300	timeout.exe
2532	timeout.exe
4796	timeout.exe
6116	timeout.exe
4400	timeout.exe
3448	timeout.exe
4456	timeout.exe
5416	timeout.exe
3328	timeout.exe
4540	timeout.exe
6040	timeout.exe
2928	timeout.exe
4792	timeout.exe
460	timeout.exe
5340	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1340	powershell.exe
1340	powershell.exe
1340	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	tasklist.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	2428	tasklist.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	1340	powershell.exe
Token: SeSecurityPrivilege	1340	powershell.exe
Token: SeTakeOwnershipPrivilege	1340	powershell.exe
Token: SeLoadDriverPrivilege	1340	powershell.exe
Token: SeSystemProfilePrivilege	1340	powershell.exe
Token: SeSystemtimePrivilege	1340	powershell.exe
Token: SeProfSingleProcessPrivilege	1340	powershell.exe
Token: SeIncBasePriorityPrivilege	1340	powershell.exe
Token: SeCreatePagefilePrivilege	1340	powershell.exe
Token: SeBackupPrivilege	1340	powershell.exe
Token: SeRestorePrivilege	1340	powershell.exe
Token: SeShutdownPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeSystemEnvironmentPrivilege	1340	powershell.exe
Token: SeRemoteShutdownPrivilege	1340	powershell.exe
Token: SeUndockPrivilege	1340	powershell.exe
Token: SeManageVolumePrivilege	1340	powershell.exe
Token: 33	1340	powershell.exe
Token: 34	1340	powershell.exe
Token: 35	1340	powershell.exe
Token: 36	1340	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe
Token: 36	4760	powershell.exe
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	1316	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	5876	tasklist.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeDebugPrivilege	5128	tasklist.exe
Token: SeDebugPrivilege	5952	tasklist.exe
Token: SeDebugPrivilege	5272	tasklist.exe
Token: SeDebugPrivilege	5340	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	5316	tasklist.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	4232	tasklist.exe
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	5460	tasklist.exe
Token: SeDebugPrivilege	4364	tasklist.exe
Token: SeDebugPrivilege	2388	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1956	4396	2026-10-26_53b557cf5b8b69112287e4987d342b3b_icedid_njrat_stealc.exe	91
PID 1956 wrote to memory of 4584	1956	cmd.exe	93
PID 4396 wrote to memory of 3664	4396	2026-10-26_53b557cf5b8b69112287e4987d342b3b_icedid_njrat_stealc.exe	96
PID 960 wrote to memory of 6140	960	PeerService.exe	98
PID 960 wrote to memory of 940	960	PeerService.exe	99
PID 3664 wrote to memory of 4716	3664	PeerService.exe	102
PID 3664 wrote to memory of 1792	3664	PeerService.exe	103
PID 940 wrote to memory of 5116	940	cmd.exe	107
PID 940 wrote to memory of 4536	940	cmd.exe	108
PID 6140 wrote to memory of 1340	6140	cmd.exe	109
PID 4716 wrote to memory of 4760	4716	cmd.exe	110
PID 1792 wrote to memory of 2428	1792	cmd.exe	111
PID 1792 wrote to memory of 4168	1792	cmd.exe	112
PID 1792 wrote to memory of 5300	1792	cmd.exe	115
PID 940 wrote to memory of 4796	940	cmd.exe	116
PID 940 wrote to memory of 5004	940	cmd.exe	117
PID 940 wrote to memory of 4960	940	cmd.exe	118
PID 1792 wrote to memory of 1316	1792	cmd.exe	119
PID 1792 wrote to memory of 2000	1792	cmd.exe	120
PID 940 wrote to memory of 1116	940	cmd.exe	121
PID 1792 wrote to memory of 1076	1792	cmd.exe	122
PID 940 wrote to memory of 2612	940	cmd.exe	123
PID 1792 wrote to memory of 3536	1792	cmd.exe	124
PID 940 wrote to memory of 4928	940	cmd.exe	125
PID 1792 wrote to memory of 2656	1792	cmd.exe	126
PID 1792 wrote to memory of 1132	1792	cmd.exe	127
PID 940 wrote to memory of 1088	940	cmd.exe	128
PID 1792 wrote to memory of 5876	1792	cmd.exe	129
PID 1792 wrote to memory of 5988	1792	cmd.exe	130
PID 940 wrote to memory of 5884	940	cmd.exe	131
PID 940 wrote to memory of 2992	940	cmd.exe	132
PID 1792 wrote to memory of 1736	1792	cmd.exe	133
PID 940 wrote to memory of 2360	940	cmd.exe	134
PID 1792 wrote to memory of 5128	1792	cmd.exe	135
PID 1792 wrote to memory of 936	1792	cmd.exe	136
PID 940 wrote to memory of 5952	940	cmd.exe	137
PID 940 wrote to memory of 5212	940	cmd.exe	138
PID 940 wrote to memory of 3504	940	cmd.exe	140
PID 1792 wrote to memory of 5652	1792	cmd.exe	139
PID 940 wrote to memory of 5272	940	cmd.exe	141
PID 940 wrote to memory of 3444	940	cmd.exe	142
PID 1792 wrote to memory of 5340	1792	cmd.exe	144
PID 1792 wrote to memory of 2104	1792	cmd.exe	145
PID 940 wrote to memory of 4540	940	cmd.exe	146
PID 1792 wrote to memory of 3328	1792	cmd.exe	147
PID 1792 wrote to memory of 3252	1792	cmd.exe	148
PID 1792 wrote to memory of 4352	1792	cmd.exe	149
PID 940 wrote to memory of 5316	940	cmd.exe	150
PID 940 wrote to memory of 1600	940	cmd.exe	151
PID 1792 wrote to memory of 4764	1792	cmd.exe	152
PID 940 wrote to memory of 4444	940	cmd.exe	153
PID 1792 wrote to memory of 2772	1792	cmd.exe	154
PID 1792 wrote to memory of 5412	1792	cmd.exe	155
PID 940 wrote to memory of 4232	940	cmd.exe	156
PID 940 wrote to memory of 4920	940	cmd.exe	157
PID 1792 wrote to memory of 6040	1792	cmd.exe	158
PID 940 wrote to memory of 2952	940	cmd.exe	159
PID 940 wrote to memory of 2764	940	cmd.exe	160
PID 940 wrote to memory of 3948	940	cmd.exe	161
PID 1792 wrote to memory of 5460	1792	cmd.exe	162
PID 1792 wrote to memory of 5608	1792	cmd.exe	163
PID 940 wrote to memory of 3272	940	cmd.exe	164
PID 1792 wrote to memory of 2364	1792	cmd.exe	165
PID 940 wrote to memory of 4364	940	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_53b557cf5b8b69112287e4987d342b3b_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_53b557cf5b8b69112287e4987d342b3b_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2428
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4168
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2000
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2656
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5876
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5340
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2104
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3252
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4352
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5608
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1660
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5004
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5856
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5384
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1532
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5996
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1564
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1820
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5176
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:360
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4372
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4140
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5916
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1896
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4188
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5080
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5960
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1600
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5544

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4536
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4796
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4960
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4928
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2992
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3444
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5316
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1600
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4920
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2952
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4296
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:600
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5848
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3500
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4388
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4932
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1812
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:936
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4996
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5904
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2792
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3372
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5316
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5192
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3116
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3448
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5864
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1124
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2596
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2656
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1460
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1964
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2796
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4736
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3644
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5128
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5028
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5464
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2876
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2072
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4340
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2772
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rr4maraz.cmg.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rr4maraz.cmg.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.5MB
SHA256 d76610357a6ffa74e0841d1085ac05e9d07b126b6c3a5b48536b7dc58d888448
MD5 a93f962fdc7ef7703d816965ca95c6d0
SHA1 cfc90244e6d52b679c78160c6f1ad06f60a3c6b1
SHA512 1a18e23a06602d1c3c4fc4e746d2e1b05fc63024cf33ba902727fef61324c9984ed0649e12a8457128021e3facf954344aac002033219478a7e53daed98745e4
SSDEEP 196608:u+hBtOkSuByQyVG/uzGNVyAl3K8fCGnbP3JzATC46:htOONSG/lVrl3KExL3JzATz6
TLSH
T1F566012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-15-0x00000230EA9D0000-0x00000230EA9F2000-memory.dmp

Download

memory/1340-20-0x00000230EAAA0000-0x00000230EAABE000-memory.dmp

Download

memory/1340-21-0x00000230EAAC0000-0x00000230EAB72000-memory.dmp

Download

memory/1340-24-0x00000230EAA90000-0x00000230EAA9A000-memory.dmp

Download