d6a912844c2b13cf80ba9fa9d2b40f3100c4232758e1ec1d2db4c3e241c6937d

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_9eb6493f421fa8b196b9d44c5fc1222a_icedid_njrat_stealc.exe
Size 3.9MB
Sample261101-158dnsdd84
SHA256 d6a912844c2b13cf80ba9fa9d2b40f3100c4232758e1ec1d2db4c3e241c6937d
MD5 9eb6493f421fa8b196b9d44c5fc1222a
SHA1 99bbe0d8d5ab75a7eeabd022c08ddddc754cdd26
SHA512 57c41a31d4dd63bfadb7088eb3c63d2ddd8fb2749610c32e3d854a644b698599f89a906f450a7f4f3fd132c7233d6aa76b85e93a5b0676b2815f97d8f69920a4
SSDEEP 98304:i+hBp75lKkBcFWGoqZ92yVG/uzGNV9HkR:i+hBtOkSoByQyVG/uzGNVyR
TLSH
T13C16D02BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5256	powershell.exe
5516	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1140	PeerService.exe
2356	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6056	tasklist.exe
1348	tasklist.exe
6056	tasklist.exe
1296	tasklist.exe
5972	tasklist.exe
3856	tasklist.exe
2996	tasklist.exe
2052	tasklist.exe
1892	tasklist.exe
4588	tasklist.exe
3136	tasklist.exe
1216	tasklist.exe
4932	tasklist.exe
4180	tasklist.exe
3856	tasklist.exe
2304	tasklist.exe
2800	tasklist.exe
6084	tasklist.exe
2584	tasklist.exe
3484	tasklist.exe
5728	tasklist.exe
5172	tasklist.exe
2772	tasklist.exe
4552	tasklist.exe
4524	tasklist.exe
5416	tasklist.exe
3492	tasklist.exe
4576	tasklist.exe
2584	tasklist.exe
236	tasklist.exe
4248	tasklist.exe
5256	tasklist.exe
3100	tasklist.exe
1196	tasklist.exe
1748	tasklist.exe
5780	tasklist.exe
4896	tasklist.exe
2848	tasklist.exe
2160	tasklist.exe
5256	tasklist.exe
1328	tasklist.exe
3680	tasklist.exe
4128	tasklist.exe
2996	tasklist.exe
5628	tasklist.exe
1112	tasklist.exe
5904	tasklist.exe
3028	tasklist.exe
6104	tasklist.exe
3756	tasklist.exe
5008	tasklist.exe
4596	tasklist.exe
5556	tasklist.exe
5184	tasklist.exe
5128	tasklist.exe
2204	tasklist.exe
1984	tasklist.exe
4512	tasklist.exe
6080	tasklist.exe
3212	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3804	cmd.exe
5164	cmd.exe
5152	cmd.exe
3052	cmd.exe
3416	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PeerService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PeerService.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1524	timeout.exe
1108	timeout.exe
4088	timeout.exe
1300	timeout.exe
4812	timeout.exe
3276	timeout.exe
1504	timeout.exe
4288	timeout.exe
1020	timeout.exe
5864	timeout.exe
2964	timeout.exe
2780	timeout.exe
3308	timeout.exe
3172	timeout.exe
2480	timeout.exe
5796	timeout.exe
3320	timeout.exe
4328	timeout.exe
252	timeout.exe
3152	timeout.exe
1224	timeout.exe
5524	timeout.exe
4888	timeout.exe
4172	timeout.exe
4688	timeout.exe
2856	timeout.exe
1844	timeout.exe
4504	timeout.exe
2116	timeout.exe
3236	timeout.exe
4472	timeout.exe
976	timeout.exe
2364	timeout.exe
1420	timeout.exe
3292	timeout.exe
3768	timeout.exe
4920	timeout.exe
1956	timeout.exe
2560	timeout.exe
5480	timeout.exe
4792	timeout.exe
4452	timeout.exe
572	timeout.exe
2492	timeout.exe
5572	timeout.exe
2132	timeout.exe
260	timeout.exe
2548	timeout.exe
4640	timeout.exe
1216	timeout.exe
1552	timeout.exe
1172	timeout.exe
5796	timeout.exe
5452	timeout.exe
5748	timeout.exe
3680	timeout.exe
4440	timeout.exe
2036	timeout.exe
3100	timeout.exe
4192	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5256	powershell.exe
5256	powershell.exe
5516	powershell.exe
5516	powershell.exe
5256	powershell.exe
5516	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	tasklist.exe
Token: SeDebugPrivilege	5256	powershell.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	5416	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5516	powershell.exe
Token: SeSecurityPrivilege	5516	powershell.exe
Token: SeTakeOwnershipPrivilege	5516	powershell.exe
Token: SeLoadDriverPrivilege	5516	powershell.exe
Token: SeSystemProfilePrivilege	5516	powershell.exe
Token: SeSystemtimePrivilege	5516	powershell.exe
Token: SeProfSingleProcessPrivilege	5516	powershell.exe
Token: SeIncBasePriorityPrivilege	5516	powershell.exe
Token: SeCreatePagefilePrivilege	5516	powershell.exe
Token: SeBackupPrivilege	5516	powershell.exe
Token: SeRestorePrivilege	5516	powershell.exe
Token: SeShutdownPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeSystemEnvironmentPrivilege	5516	powershell.exe
Token: SeRemoteShutdownPrivilege	5516	powershell.exe
Token: SeUndockPrivilege	5516	powershell.exe
Token: SeManageVolumePrivilege	5516	powershell.exe
Token: 33	5516	powershell.exe
Token: 34	5516	powershell.exe
Token: 35	5516	powershell.exe
Token: 36	5516	powershell.exe
Token: SeIncreaseQuotaPrivilege	5256	powershell.exe
Token: SeSecurityPrivilege	5256	powershell.exe
Token: SeTakeOwnershipPrivilege	5256	powershell.exe
Token: SeLoadDriverPrivilege	5256	powershell.exe
Token: SeSystemProfilePrivilege	5256	powershell.exe
Token: SeSystemtimePrivilege	5256	powershell.exe
Token: SeProfSingleProcessPrivilege	5256	powershell.exe
Token: SeIncBasePriorityPrivilege	5256	powershell.exe
Token: SeCreatePagefilePrivilege	5256	powershell.exe
Token: SeBackupPrivilege	5256	powershell.exe
Token: SeRestorePrivilege	5256	powershell.exe
Token: SeShutdownPrivilege	5256	powershell.exe
Token: SeDebugPrivilege	5256	powershell.exe
Token: SeSystemEnvironmentPrivilege	5256	powershell.exe
Token: SeRemoteShutdownPrivilege	5256	powershell.exe
Token: SeUndockPrivilege	5256	powershell.exe
Token: SeManageVolumePrivilege	5256	powershell.exe
Token: 33	5256	powershell.exe
Token: 34	5256	powershell.exe
Token: 35	5256	powershell.exe
Token: 36	5256	powershell.exe
Token: SeDebugPrivilege	6056	tasklist.exe
Token: SeDebugPrivilege	3856	tasklist.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	5128	tasklist.exe
Token: SeDebugPrivilege	1296	tasklist.exe
Token: SeDebugPrivilege	5972	tasklist.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	3492	tasklist.exe
Token: SeDebugPrivilege	5628	tasklist.exe
Token: SeDebugPrivilege	2996	tasklist.exe
Token: SeDebugPrivilege	4596	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	3484	tasklist.exe
Token: SeDebugPrivilege	2304	tasklist.exe
Token: SeDebugPrivilege	5556	tasklist.exe
Token: SeDebugPrivilege	6104	tasklist.exe
Token: SeDebugPrivilege	5256	tasklist.exe
Token: SeDebugPrivilege	6084	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 3052	5620	2026-10-31_9eb6493f421fa8b196b9d44c5fc1222a_icedid_njrat_stealc.exe	90
PID 3052 wrote to memory of 2036	3052	cmd.exe	92
PID 5620 wrote to memory of 1140	5620	2026-10-31_9eb6493f421fa8b196b9d44c5fc1222a_icedid_njrat_stealc.exe	93
PID 1140 wrote to memory of 3804	1140	PeerService.exe	96
PID 1140 wrote to memory of 3416	1140	PeerService.exe	97
PID 2356 wrote to memory of 5164	2356	PeerService.exe	101
PID 5164 wrote to memory of 5516	5164	cmd.exe	104
PID 2356 wrote to memory of 5152	2356	PeerService.exe	105
PID 3804 wrote to memory of 5256	3804	cmd.exe	106
PID 3416 wrote to memory of 4524	3416	cmd.exe	108
PID 3416 wrote to memory of 1396	3416	cmd.exe	109
PID 5152 wrote to memory of 5416	5152	cmd.exe	110
PID 5152 wrote to memory of 5796	5152	cmd.exe	111
PID 3416 wrote to memory of 2492	3416	cmd.exe	114
PID 5152 wrote to memory of 2364	5152	cmd.exe	115
PID 3416 wrote to memory of 6056	3416	cmd.exe	116
PID 3416 wrote to memory of 1524	3416	cmd.exe	117
PID 5152 wrote to memory of 3856	5152	cmd.exe	118
PID 5152 wrote to memory of 2448	5152	cmd.exe	119
PID 3416 wrote to memory of 4172	3416	cmd.exe	120
PID 5152 wrote to memory of 5748	5152	cmd.exe	121
PID 5152 wrote to memory of 4128	5152	cmd.exe	122
PID 5152 wrote to memory of 2212	5152	cmd.exe	123
PID 3416 wrote to memory of 5128	3416	cmd.exe	124
PID 3416 wrote to memory of 1220	3416	cmd.exe	125
PID 5152 wrote to memory of 4288	5152	cmd.exe	126
PID 3416 wrote to memory of 3236	3416	cmd.exe	127
PID 5152 wrote to memory of 1296	5152	cmd.exe	128
PID 5152 wrote to memory of 5064	5152	cmd.exe	129
PID 3416 wrote to memory of 5972	3416	cmd.exe	130
PID 3416 wrote to memory of 4996	3416	cmd.exe	131
PID 3416 wrote to memory of 5572	3416	cmd.exe	132
PID 5152 wrote to memory of 5480	5152	cmd.exe	133
PID 3416 wrote to memory of 4512	3416	cmd.exe	134
PID 3416 wrote to memory of 2824	3416	cmd.exe	135
PID 5152 wrote to memory of 3492	5152	cmd.exe	136
PID 5152 wrote to memory of 4420	5152	cmd.exe	137
PID 3416 wrote to memory of 1216	3416	cmd.exe	138
PID 5152 wrote to memory of 2780	5152	cmd.exe	139
PID 3416 wrote to memory of 5628	3416	cmd.exe	140
PID 3416 wrote to memory of 5632	3416	cmd.exe	141
PID 5152 wrote to memory of 2996	5152	cmd.exe	142
PID 5152 wrote to memory of 2860	5152	cmd.exe	143
PID 5152 wrote to memory of 2036	5152	cmd.exe	144
PID 3416 wrote to memory of 4688	3416	cmd.exe	145
PID 5152 wrote to memory of 4596	5152	cmd.exe	147
PID 5152 wrote to memory of 2616	5152	cmd.exe	148
PID 3416 wrote to memory of 3028	3416	cmd.exe	149
PID 3416 wrote to memory of 4328	3416	cmd.exe	150
PID 5152 wrote to memory of 5524	5152	cmd.exe	151
PID 3416 wrote to memory of 1020	3416	cmd.exe	152
PID 3416 wrote to memory of 3484	3416	cmd.exe	153
PID 3416 wrote to memory of 1368	3416	cmd.exe	154
PID 5152 wrote to memory of 2304	5152	cmd.exe	155
PID 5152 wrote to memory of 712	5152	cmd.exe	156
PID 3416 wrote to memory of 3308	3416	cmd.exe	157
PID 5152 wrote to memory of 3172	5152	cmd.exe	158
PID 5152 wrote to memory of 5556	5152	cmd.exe	159
PID 5152 wrote to memory of 5804	5152	cmd.exe	160
PID 3416 wrote to memory of 6104	3416	cmd.exe	161
PID 3416 wrote to memory of 1680	3416	cmd.exe	162
PID 5152 wrote to memory of 976	5152	cmd.exe	163
PID 3416 wrote to memory of 4192	3416	cmd.exe	164
PID 3416 wrote to memory of 5256	3416	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9eb6493f421fa8b196b9d44c5fc1222a_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9eb6493f421fa8b196b9d44c5fc1222a_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4524
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1524
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1220
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4996
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5632
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3484
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6104
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3680
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5484
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4180
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2996
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4896
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4680
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6080
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4348
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5256
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1540
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2492
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4692
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4248
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5004
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3100
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4932
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1560
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2772
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5096
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2584
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2108
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4812
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3828
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1956

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5796
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2448
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5064
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5480
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2616
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:712
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5804
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:976
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2932
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5796
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1524
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3856
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2448
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5864
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5780
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4292
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5708
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2772
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1552
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2584
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4580
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:236
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5804
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2160
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5008
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3136
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2800
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1348
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4956
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1216
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2892
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1196
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2516
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4440
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:1984
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4204
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4396
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5904
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ujaykcbd.vp3.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujaykcbd.vp3.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 3.1MB
SHA256 e4cc070c837e1ba843facc5fc804f9659df31d5ae9f25c96f907dd1321dba23d
MD5 34035187114e4de0f80b8546bb16099f
SHA1 7e51d9550278e9ec8441d47330449520ea44cff3
SHA512 2d63d7e9ad52809a0db8d998e826cc439524688601415248ab62c7fde10df5748011d74a2be2a74f0537e5ce26f162e1255b457d7ca8f15c2cb5603cc483b3d1
SSDEEP 49152:i++MB9P91XphIl8pF58HsKkZrXvCHL6Qu2XG8ZoI9Z9rqyI44Hppuzy:i+hBp75lKkBcJWGoqZ92yVG/uzy
TLSH
T14CE5BF2BB26901ECE1BFD17CC9165907EBB1780503A0A7DF12E046A62F77AE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5256-21-0x0000029E1C990000-0x0000029E1CA42000-memory.dmp

Download

memory/5256-20-0x0000029E1C970000-0x0000029E1C98E000-memory.dmp

Download

memory/5256-24-0x0000029E1CFD0000-0x0000029E1CFDA000-memory.dmp

Download

memory/5516-15-0x0000027503410000-0x0000027503432000-memory.dmp

Download