Analysis
- user interaction
yes - max time kernel
57s - max time network
52s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 04:07
Behavioral task
behavioral1
Sample
XLN_KeyGen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
XLN_KeyGen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target XLN_KeyGen.exe
- Size 799KB
- Sample260808-eps36azejf
- SHA256 0727f0747bbdc0ba30ae6b8ffdd568244c246fd3c794089379c11d53fbf260f1
- MD5 a2beab5ab9e3325e28caff996455e384
- SHA1 b294dbb724464c2d295a72a3c1ec32ce8c67dd72
- SHA512 8ee1fbe4fb6d9d9d41300c8fbd07dbbf5ddad0e5a23fc82aca8c86e6f74e932f46d7b8bf66417025e89ea4f3b0c19e4c591fa2093029a05a55455e543183af1b
- SSDEEP 12288:3c9t2Sll4hOQXpouVFn9OciibEgtUSdpJvaUUbx6ls86y9Mx:3cLGR3HAciiptUkvanAs81+
- TLSH T162052350BBD445A7D46D43791573EBD1BBFA7F201266020BBBED3F3E10B2282911A687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4472 keygen.exe - Loads dropped DLL 3 IoCs
pid Process 4472 keygen.exe 4472 keygen.exe 4472 keygen.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLN_KeyGen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keygen.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 2836 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2836 AUDIODG.EXE Token: SeDebugPrivilege 5976 taskmgr.exe Token: SeSystemProfilePrivilege 5976 taskmgr.exe Token: SeCreateGlobalPrivilege 5976 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe 5976 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5976 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5780 wrote to memory of 4472 5780 XLN_KeyGen.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\XLN_KeyGen.exe"C:\Users\Admin\AppData\Local\Temp\XLN_KeyGen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\keygen.exeC:\Users\Admin\AppData\Local\Temp\keygen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4472
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F81⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R2RXLNKG.dll
- Size 7KB
- SHA256 6dce820b12b8fa96df5e308c4d9c1cfde93b314636bc03c6b945dafdc00a5411
- MD5 c1c6c2eabdd4688bda12c8aab5596e7c
- SHA1 7660c87b713076ed60126cb21fcb7aec575752b3
- SHA512 ee9e21af755f2bb2fddc5076dcf15bdbb712371c908c2bc10dcb33ee1540ad2f793181b2da1a74d0f375d18ae4436507770c0fcecab0bc7a9f298babad6c5f49
- SSDEEP 192:oT5mxeH8GGp1PCKYyj4gXi9GsD1jzGgv:eo7q/gLQJ
- TLSH T11FE1D67792C68490F2D502F51BF2EFDC502DB8112B21B7F76732A87518E49D1BA37612
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bgm.mod
- Size 606KB
- SHA256 7aa1e2789c5222a5cdd09125cb268a28569a482e7ced85b150b27e0c57ad1e9a
- MD5 179949db15dc96c6f242c1969a033543
- SHA1 73046a24a10bc8475a20c31f4cdb7b27d7ffc055
- SHA512 14dc62014671092c20c7a36357a62c6bfa98fb5ec97a394419dc7437faff3d20ff015e9ef4b7b5d31250c5730933836629f47ac329f5055b350c022f5a61e3b5
- SSDEEP 12288:rt1WorOFjL0Ikkf5vlQ9HVbvWSiiafw19q9XiVlXknibpcwluf/I:rjWorvQf5vW91iSii/l9/pcyu4
- TLSH T13CD4D033FF86B84AE0982F3545AD5A1A6334FA491F7216CF3B4A6D755A7B3822C30711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
- Size 444KB
- SHA256 c10b62df47adfd347748241c8ac86436ca5a3965c0b227d3d148ccbf6728176b
- MD5 c1bd67287fcb7d4c3f6753518aac6123
- SHA1 01a2cde43e495322d42c7148456740d847029cf8
- SHA512 a9ffb90c8e1e8faee286b000c18a28c3f67c4d52bf1c69f393c5eea3f8af387bf2873c1cf81736c7307129a038209e3b6efc4e8f76b9b7dd8c93c93ec763a85a
- SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAONEiFGn4eg6QKxE1aal/p:ic/kEPDonR6Y436vREiFGnJEFp
- TLSH T153A47B419382CE78F2DA81B98DFB7B2BE12062245712A5F7C25B3E37ADE42DD1C74215
- MD5 SHA1 SHA512 SSDEEP TLSH