Analysis
- geolocation tags
asiadelhiinindia - max time kernel
899s - max time network
897s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/11/2026, 01:02
Behavioral task
behavioral1
Sample
Payload_Slayed.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
Payload_Slayed.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
Payload_Slayed.exe
Resource
win11-20260911-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral4
Sample
Payload_Slayed.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
900 seconds
General
- Target Payload_Slayed.exe
- Size 53KB
- Sample261107-bdsfpsvtby
- SHA256 3e647892191594cfc6715d9c6e59f4bc97f8c44e83bec42e71eac792bc97e7f9
- MD5 a6c54fad6de5293cf09941e8f6189a97
- SHA1 58a467b5cad4cee944e00dc8c332694f31e71a8f
- SHA512 bf5ab80f7701a460d02c9f51f4ddc66fa20a4a4e313e88d812287a57af35bcda925002735b91617461c04d3d7340ae32320469756dab663dbc8bb1edfc55e1c9
- SSDEEP 1536:kKGOf5NgvFjEmXt6j6F8PQuIDxXExI3pmEm:KOqFjEmXA+8PQuIDxXExI3pm
- TLSH T172334944BFEA5A01E2BD8F7458B995150A34FA23E532D71E48D668DB13337C49C88FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 Payload_Slayed.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6072 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Payload_Slayed.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Payload_Slayed.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload_Slayed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Kills process with taskkill 1 IoCs
pid Process 5812 taskkill.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1304 Payload_Slayed.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5812 taskkill.exe Token: SeDebugPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe Token: 33 1304 Payload_Slayed.exe Token: SeIncBasePriorityPrivilege 1304 Payload_Slayed.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1304 wrote to memory of 6072 1304 Payload_Slayed.exe 80 PID 6072 wrote to memory of 5812 6072 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\Payload_Slayed.exe"1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im Wireshark.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Wireshark.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5812
-
-