Analysis
- user interaction
yes - max time kernel
1050s - max time network
472s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/08/2026, 03:15
Behavioral task
behavioral1
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target XClient-cleaned-cleaned_Slayed.exe
- Size 88KB
- Sample260814-dr286stthx
- SHA256 57bd51a7238d3046f49df299cbee125c46238c5fcb7586739b7dd4bc8227de1b
- MD5 255999e54fba180195e0115dc5b0c065
- SHA1 637b50a06fedc86b028c36702a9936722ae23930
- SHA512 a6766be170e2b7db38f5cb9bf6090b553880c4415574d8fe8716aa3d8a7a2af3c72a11ba97afae4ac31385ea38e7bee90972b759a3cea03326a571d7fc9758f4
- SSDEEP 1536:iNUHlp4qxH5NR4ltK7haGHk1izd+eulpu/46aZesa9Yhh6PDOgS:KU8CZ1YhhUz
- TLSH T1E893188937B52524E4BF9FF16835B2408D39B5075602E7AE58E24ADE1F336C44B08BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3404 netsh.exe 2500 netsh.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2876 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XClient-cleaned-cleaned_Slayed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2876 cmd.exe 688 PING.EXE - Runs ping.exe 1 TTPs 1 IoCs
pid Process 688 PING.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4364 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4364 XClient-cleaned-cleaned_Slayed.exe Token: 33 4364 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4364 wrote to memory of 3404 4364 XClient-cleaned-cleaned_Slayed.exe 85 PID 4364 wrote to memory of 2500 4364 XClient-cleaned-cleaned_Slayed.exe 99 PID 4364 wrote to memory of 2876 4364 XClient-cleaned-cleaned_Slayed.exe 101 PID 2876 wrote to memory of 688 2876 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe" "XClient-cleaned-cleaned_Slayed.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3404
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:688
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1