Analysis
- user interaction
yes - max time kernel
1050s - max time network
472s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/08/2026, 03:15
Behavioral task
behavioral1
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target XClient-cleaned-cleaned_Slayed.exe
- Size 88KB
- Sample260814-dr286stthx
- SHA256 57bd51a7238d3046f49df299cbee125c46238c5fcb7586739b7dd4bc8227de1b
- MD5 255999e54fba180195e0115dc5b0c065
- SHA1 637b50a06fedc86b028c36702a9936722ae23930
- SHA512 a6766be170e2b7db38f5cb9bf6090b553880c4415574d8fe8716aa3d8a7a2af3c72a11ba97afae4ac31385ea38e7bee90972b759a3cea03326a571d7fc9758f4
- SSDEEP 1536:iNUHlp4qxH5NR4ltK7haGHk1izd+eulpu/46aZesa9Yhh6PDOgS:KU8CZ1YhhUz
- TLSH T1E893188937B52524E4BF9FF16835B2408D39B5075602E7AE58E24ADE1F336C44B08BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3588 netsh.exe 5108 netsh.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 856 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XClient-cleaned-cleaned_Slayed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 856 cmd.exe 3428 PING.EXE - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3428 PING.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4288 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 4288 XClient-cleaned-cleaned_Slayed.exe Token: 33 4288 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4288 wrote to memory of 3588 4288 XClient-cleaned-cleaned_Slayed.exe 80 PID 4288 wrote to memory of 5108 4288 XClient-cleaned-cleaned_Slayed.exe 83 PID 4288 wrote to memory of 856 4288 XClient-cleaned-cleaned_Slayed.exe 84 PID 856 wrote to memory of 3428 856 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe" "XClient-cleaned-cleaned_Slayed.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3588
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5108
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3428
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1