Analysis
- user interaction
yes - max time kernel
1049s - max time network
548s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
14/08/2026, 03:15
Behavioral task
behavioral1
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target XClient-cleaned-cleaned_Slayed.exe
- Size 88KB
- Sample260814-dr286stthx
- SHA256 57bd51a7238d3046f49df299cbee125c46238c5fcb7586739b7dd4bc8227de1b
- MD5 255999e54fba180195e0115dc5b0c065
- SHA1 637b50a06fedc86b028c36702a9936722ae23930
- SHA512 a6766be170e2b7db38f5cb9bf6090b553880c4415574d8fe8716aa3d8a7a2af3c72a11ba97afae4ac31385ea38e7bee90972b759a3cea03326a571d7fc9758f4
- SSDEEP 1536:iNUHlp4qxH5NR4ltK7haGHk1izd+eulpu/46aZesa9Yhh6PDOgS:KU8CZ1YhhUz
- TLSH T1E893188937B52524E4BF9FF16835B2408D39B5075602E7AE58E24ADE1F336C44B08BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1192 netsh.exe 4204 netsh.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3368 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XClient-cleaned-cleaned_Slayed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4084 PING.EXE 3368 cmd.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4084 PING.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 652 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 652 XClient-cleaned-cleaned_Slayed.exe Token: 33 652 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 652 wrote to memory of 1192 652 XClient-cleaned-cleaned_Slayed.exe 84 PID 652 wrote to memory of 4204 652 XClient-cleaned-cleaned_Slayed.exe 94 PID 652 wrote to memory of 3368 652 XClient-cleaned-cleaned_Slayed.exe 96 PID 3368 wrote to memory of 4084 3368 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe" "XClient-cleaned-cleaned_Slayed.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1192
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4084
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1