Analysis
- max time kernel
149s - max time network
69s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/06/2026, 22:31
General
- Target apollo.exe
- Size 2.0MB
- Sample260610-2ft1esf19w
- SHA256 b787eaa33fdb5964e692956f008cb3d0130d0f91685730f601289d37ffdd2c79
Malware Config
Signatures
- Family: MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
- Detects MythicApollo 3 IoCs
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\apollo.exe"C:\Users\Admin\AppData\Local\Temp\apollo.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4160-0-0x0000026FA20F0000-0x0000026FA22EA000-memory.dmp
memory/4160-1-0x0000026FBDEE0000-0x0000026FBDEF0000-memory.dmp
memory/4160-2-0x0000026FA2790000-0x0000026FA27E4000-memory.dmp
memory/4160-8-0x0000026FBDDC0000-0x0000026FBDDC8000-memory.dmp
memory/4160-9-0x0000026FBDDD0000-0x0000026FBDDDA000-memory.dmp
memory/4160-7-0x0000026FA40D0000-0x0000026FA40E0000-memory.dmp
memory/4160-6-0x0000026FA40C0000-0x0000026FA40CE000-memory.dmp
memory/4160-5-0x0000026FA2700000-0x0000026FA270E000-memory.dmp
memory/4160-4-0x0000026FA40B0000-0x0000026FA40BA000-memory.dmp
memory/4160-3-0x0000026FA40A0000-0x0000026FA40AA000-memory.dmp
memory/4160-10-0x0000026FBDEF0000-0x0000026FBE05A000-memory.dmp
memory/4160-11-0x0000026FBDE40000-0x0000026FBDE4A000-memory.dmp
memory/4160-12-0x0000026FBDE60000-0x0000026FBDE6A000-memory.dmp
memory/4160-13-0x0000026FC01D0000-0x0000026FC0282000-memory.dmp
memory/4160-14-0x0000026FC0280000-0x0000026FC02A2000-memory.dmp