0c10769b277cf217dae2877ecd476e70413907f4eb7a70de55c2fba4edc947ea

Analysis

user interaction
yes
max time kernel
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XLN_KG.exe
Size 800KB
Sample261011-e9a33sdy6m
SHA256 0c10769b277cf217dae2877ecd476e70413907f4eb7a70de55c2fba4edc947ea
MD5 952d893926df7a8d5879f2ffeb96e96e
SHA1 2a2f3faa2c7670a52e27b838c81737e6c9b4f965
SHA512 4e456fdfac6ea38d0746b2a516c04fd797f75def9dfe3b2fd7a2c1f934f14f1f644e61809d660c542ffbce9e2198651a8376f5c92a2afe5455e286e051a34a56
SSDEEP 24576:UcLjNw85Iyerj0xe41VExk6DVPiFeoMkPr4Q:UAemLEj0xeuqifPr4Q
TLSH
T13B052326BAA444D3EDF30BB114FFD964B1BBAE678B02158F62C5BF395532742600B243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5748	keygen.exe

Loads dropped DLL 2 IoCs

pid	Process
5748	keygen.exe
5748	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	keygen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	keygen.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XLN_KG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Colors	keygen.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f483accbfb42cdb4c42b0297fe99a87c6410000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\NotificationData	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4280	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4464	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5748	keygen.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 5748	1804	XLN_KG.exe	89

C:\Users\Admin\AppData\Local\Temp\XLN_KG.exe
"C:\Users\Admin\AppData\Local\Temp\XLN_KG.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LicensesOI.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RXLNKG.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RXLNKG.dll
Size 6KB
SHA256 76d9ffeeb89773c56d58fd8935c2d310aacdae3b590f3cc7aa24ed267339a735
MD5 edc9d719c3bdb5702e28abf9df8359b6
SHA1 d433026c1a8c51552d1ad657a8fccf81cc73ac76
SHA512 a7f866c2bce0e73d893bc07d5a298f5905ea3cddd11e111e5c1195959a9e5f2a0607670b6506860cadd1fa88eef05bf23063128c0d806184ec35d9daa0327197
SSDEEP 96:MuPsNE+ByIO4EOkkIrZjr1LTReB55H7bl01tzDAQ2bJJ:M39BLEOqjr9TGD2TDAQ2
TLSH
T1CBC1E63753E148C3E1B686B03B75EF4D15ADF4212120B6A8CB21C8493DE8696FE17766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.mod

Path C:\Users\Admin\AppData\Local\Temp\bgm.mod
Size 606KB
SHA256 7aa1e2789c5222a5cdd09125cb268a28569a482e7ced85b150b27e0c57ad1e9a
MD5 179949db15dc96c6f242c1969a033543
SHA1 73046a24a10bc8475a20c31f4cdb7b27d7ffc055
SHA512 14dc62014671092c20c7a36357a62c6bfa98fb5ec97a394419dc7437faff3d20ff015e9ef4b7b5d31250c5730933836629f47ac329f5055b350c022f5a61e3b5
SSDEEP 12288:rt1WorOFjL0Ikkf5vlQ9HVbvWSiiafw19q9XiVlXknibpcwluf/I:rjWorvQf5vW91iSii/l9/pcyu4
TLSH
T13CD4D033FF86B84AE0982F3545AD5A1A6334FA491F7216CF3B4A6D755A7B3822C30711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 443KB
SHA256 5c9509349f39b2fcade22eb219126d45831920fcb4f319191f2f4a9e7643371a
MD5 2cf51f0737ff7c3b804f5c9646b627c7
SHA1 d37ec75aca03b01e7f79d760a9ba02ec2b03eff4
SHA512 ebd931371967f129aa2dd2051c89fd15d6f615a55edfb5f25dc7d518254c8b9625fec9f35e76f72e532337aeefd89bd5ff713df85a6904c483d37f41a133aad7
SSDEEP 6144:bcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOYyFGn4eg6QKxE1aal/i:bc/kEPDonR6Y436vRjFGnJEFi
TLSH
T171A46A419382CE78F2DA82B98DFB7B2BE12062245712A5F7C2573E379DE42DD1C74219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicensesOI.txt

Path C:\Users\Admin\Desktop\LicensesOI.txt
Size 1KB
SHA256 2e8aaa03f25c27d311c6b4547d745d3e6308a73c4d07db3dbd76dc6ec7e570c9
MD5 6f22b1d2fd69cf7ddb4664af89a092bf
SHA1 52720f5cec1fb446b21453545168b43ebf842774
SHA512 99dd1e1b2a67f86b318ddd20776fbf72432a31ea8e825758b67bcdb8858c732d9df5bc996bea15658a2abd98e758552c810782056613775b8db9106a91258360
TLSH
T1BD41F05E1008488F772B3DA9D8F6BE2756D365560F3B888AF0D7ADFB793631A1446204
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5748-20-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-23-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-16-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-18-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-19-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-12-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-21-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-15-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5748-25-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-26-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-27-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-28-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-29-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5748-30-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads