Analysis
- geolocation tags
asiadelhiinindia - user interaction
yes - max time kernel
900s - max time network
726s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 01:02
Behavioral task
behavioral1
Sample
Payload_Slayed.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
Payload_Slayed.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
Payload_Slayed.exe
Resource
win11-20260911-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral4
Sample
Payload_Slayed.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
900 seconds
General
- Target Payload_Slayed.exe
- Size 53KB
- Sample261107-bdsfpsvtby
- SHA256 3e647892191594cfc6715d9c6e59f4bc97f8c44e83bec42e71eac792bc97e7f9
- MD5 a6c54fad6de5293cf09941e8f6189a97
- SHA1 58a467b5cad4cee944e00dc8c332694f31e71a8f
- SHA512 bf5ab80f7701a460d02c9f51f4ddc66fa20a4a4e313e88d812287a57af35bcda925002735b91617461c04d3d7340ae32320469756dab663dbc8bb1edfc55e1c9
- SSDEEP 1536:kKGOf5NgvFjEmXt6j6F8PQuIDxXExI3pmEm:KOqFjEmXA+8PQuIDxXExI3pm
- TLSH T172334944BFEA5A01E2BD8F7458B995150A34FA23E532D71E48D668DB13337C49C88FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 Payload_Slayed.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5988 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Payload_Slayed.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Payload_Slayed.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload_Slayed.exe - Kills process with taskkill 1 IoCs
pid Process 3668 taskkill.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4700 Payload_Slayed.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3668 taskkill.exe Token: SeDebugPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe Token: 33 4700 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 4700 Payload_Slayed.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4700 wrote to memory of 5988 4700 Payload_Slayed.exe 92 PID 5988 wrote to memory of 3668 5988 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\Payload_Slayed.exe"1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im Wireshark.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Wireshark.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-