Analysis
- user interaction
yes - max time kernel
274s - max time network
269s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 03:15
Behavioral task
behavioral1
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
XClient-cleaned-cleaned_Slayed.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target XClient-cleaned-cleaned_Slayed.exe
- Size 88KB
- Sample260814-dr286stthx
- SHA256 57bd51a7238d3046f49df299cbee125c46238c5fcb7586739b7dd4bc8227de1b
- MD5 255999e54fba180195e0115dc5b0c065
- SHA1 637b50a06fedc86b028c36702a9936722ae23930
- SHA512 a6766be170e2b7db38f5cb9bf6090b553880c4415574d8fe8716aa3d8a7a2af3c72a11ba97afae4ac31385ea38e7bee90972b759a3cea03326a571d7fc9758f4
- SSDEEP 1536:iNUHlp4qxH5NR4ltK7haGHk1izd+eulpu/46aZesa9Yhh6PDOgS:KU8CZ1YhhUz
- TLSH T1E893188937B52524E4BF9FF16835B2408D39B5075602E7AE58E24ADE1F336C44B08BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1476 netsh.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XClient-cleaned-cleaned_Slayed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1392 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe Token: SeIncBasePriorityPrivilege 1392 XClient-cleaned-cleaned_Slayed.exe Token: 33 1392 XClient-cleaned-cleaned_Slayed.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1392 wrote to memory of 1476 1392 XClient-cleaned-cleaned_Slayed.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\XClient-cleaned-cleaned_Slayed.exe" "XClient-cleaned-cleaned_Slayed.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1476
-