Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 00:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
clp8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
clp8.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target clp8.exe
- Size 232KB
- Sample260620-akanssdv4y
- SHA256 cc11ed29c8244abc04aa05618154317c550f90a519809849b7cba0aa8badc7c8
- MD5 234ce8b2531070f273ececb213be9366
- SHA1 d626aa5c9870c9281c613d4b064a5a84585958c9
- SHA512 17b480bb5ad790f591aa78c94bcd51c1e0ae9302896658bd7511912d0d9fa171f08517996b39b36a768f4658f8aebc5035019c580488bba95335d997820cd617
- SSDEEP 6144:q0WoKA+vzDrCztDMcwW00M+wbv2dB+c/s/kO:hyzDrCwF+Gv2+1
- TLSH T10E34CF5BB3A034F9D5768278C8145A06E776B8350771DBAF03A043A67F232D19D3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xtinyloader
C2
-
62.60.226.159
Wallets
-
DMhezYpB8cwkowfd8yDLXJc9d4UG58kBoN
-
LZn3xapzEyVf1U8iKJYXY1JudgvHZuBh9e
-
THazR2pvbaHR8NtMXGT3eHSs6wdv8qqtJN
-
0xe28a5e633ef952706996a6da42cba51babb8dc44
-
1Mfq381SMtJm9ir4EjfTycnMn5RVPc3tCZ
Signatures
- Family: XTinyLoader
XTinyLoader is a modular loader and stealer.
- Executes dropped EXE 2 IoCs
pid Process 3468 Process not Found 4108 WindowsStore.Update.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSvcHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\WindowsStore.Update.exe" clp8.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3784 clp8.exe 3784 clp8.exe 3468 Process not Found 3468 Process not Found 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe 3784 clp8.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3468 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3784 clp8.exe Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found Token: SeShutdownPrivilege 3468 Process not Found Token: SeCreatePagefilePrivilege 3468 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process PID 3468 wrote to memory of 4720 3468 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\clp8.exe"C:\Users\Admin\AppData\Local\Temp\clp8.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exeC:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe1⤵
- Executes dropped EXE
PID:4108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe
- Size 232KB
- SHA256 cc11ed29c8244abc04aa05618154317c550f90a519809849b7cba0aa8badc7c8
- MD5 234ce8b2531070f273ececb213be9366
- SHA1 d626aa5c9870c9281c613d4b064a5a84585958c9
- SHA512 17b480bb5ad790f591aa78c94bcd51c1e0ae9302896658bd7511912d0d9fa171f08517996b39b36a768f4658f8aebc5035019c580488bba95335d997820cd617
- SSDEEP 6144:q0WoKA+vzDrCztDMcwW00M+wbv2dB+c/s/kO:hyzDrCwF+Gv2+1
- TLSH T10E34CF5BB3A034F9D5768278C8145A06E776B8350771DBAF03A043A67F232D19D3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vsruntime27475.tmp
- Size 109KB
- SHA256 0e4c4101fe87dfcc8d0658421108b3ba8921011d53f39b6c903c988e0a434e41
- MD5 aa164e2a4b35a2e17530f4d356ae654c
- SHA1 9088e5e512883c4898fdeeb11dc5cc5c0782a32e
- SHA512 ef1bf56ee417d7dd9a79b68f00f2bd6bcd3fcbe0042c71d883c5652f9369428253204411b25c995dffffa3d1f9e5331523d23441ab540bf34e2d56cf0cf3e014
- SSDEEP 1536:xDUYUvkWsLfGbpbFFCgVJ1QsSagU6wLvTDoSPJssWVd09dl2cRsh:xjUvkJLfG9bFkgBQsp6wLvTUSP0MAca
- TLSH T110B36B5BB3E400BFE4768674C9634906D77678120B21DBAF13A482A92F737D19D3AF60
- MD5 SHA1 SHA512 SSDEEP TLSH