xtinyloader | 01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8

Resubmissions

06/07/2026, 05:36

260706-gap43aat3z10

03/07/2026, 12:41

260703-pw1rpahv4w10

Analysis

max time kernel
298s
max time network
253s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8.exe
Size 27KB
Sample260706-gap43aat3z
SHA256 01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8
MD5 63b37292ab95fe1a8262b74392d7ab3f
SHA1 211595d337cbb4ff2dbd2e9a030dc36a41e55877
SHA512 7643de7bd747c23caed5aac87ce7dc26448b893d6cf9078ebd56cd9c141baa4e873d69a5cb86d7cf0f0a49304068027efeb3758140e5341dbf0c8576e95006bb
SSDEEP 768:RNIikyGe4EJYAAbFsukvZpk2AmzJkBwASd:/9GepEkAQSWX
TLSH
T107C2382E07E501FCEA1A82F4CC75A827D370F4472EF1568E4272D9D6AF426D2AD2C785
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xtinyloader loader persistence stealer

Malware Config

Extracted

Family

xtinyloader

196.251.107.130

Wallets

TBfVoNhyiBzrWXRi9erWH1d8BdpFNoB7dt

Signatures

Family: XTinyLoader
XTinyLoader is a modular loader and stealer.
loader stealer xtinyloader

Executes dropped EXE 2 IoCs

pid	Process
1976	pglpy.exe
5780	pglpy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows\CurrentVersion\Run\texpl = "C:\\ProgramData\\pglpy.exe"	01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1976	2564	01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8.exe	88

C:\Users\Admin\AppData\Local\Temp\01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8.exe
"C:\Users\Admin\AppData\Local\Temp\01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2564
- C:\ProgramData\pglpy.exe
  "C:\ProgramData\pglpy.exe"
  2⤵
  - Executes dropped EXE
  PID:1976

C:\ProgramData\pglpy.exe
C:\ProgramData\pglpy.exe
1⤵
- Executes dropped EXE
PID:5780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pglpy.exe

Path C:\ProgramData\pglpy.exe
Size 27KB
SHA256 01d56e9f4bfc02d3b968b1cea2f4ed8870df97ac4caba245e528ee5ddbe1d8c8
MD5 63b37292ab95fe1a8262b74392d7ab3f
SHA1 211595d337cbb4ff2dbd2e9a030dc36a41e55877
SHA512 7643de7bd747c23caed5aac87ce7dc26448b893d6cf9078ebd56cd9c141baa4e873d69a5cb86d7cf0f0a49304068027efeb3758140e5341dbf0c8576e95006bb
SSDEEP 768:RNIikyGe4EJYAAbFsukvZpk2AmzJkBwASd:/9GepEkAQSWX
TLSH
T107C2382E07E501FCEA1A82F4CC75A827D370F4472EF1568E4272D9D6AF426D2AD2C785
MD5 SHA1 SHA512 SSDEEP TLSH

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads