18dd5e7967a46e933cf61f4a46efd5c7230fddd3097647050d7a39828f1fa354

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppleCleaner (1).exe
Size 4.1MB
Sample260720-t8596aas7w
SHA256 18dd5e7967a46e933cf61f4a46efd5c7230fddd3097647050d7a39828f1fa354
MD5 36f1af84dca2da2c03a7730a0f3c0d51
SHA1 ca8a525d402426e0724504c25d4473171ff57f3c
SHA512 ddbc25aebad0db9db9fdc7fe5d510677c8d5b4fd23b58fa2b039292168e594aa5e564f8529f56c3357e9159afeb328e1b90e193487a7d7c4ce19691a2e918242
SSDEEP 98304:3sfadOQI108N97YsZKVJ/isNtGLhk5l5Ylr5ZGX9XLL8ox3iC:3UDQiY//LNWhk5l5YJC3n/
TLSH
T15616333EB9E35ED7D7989636FC8660863096394681CABB81476F2403D33BD660F0552F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AppleCleaner (1).exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AppleCleaner (1).exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2856-0-0x0000000140000000-0x0000000140AA9000-memory.dmp	themida
behavioral2/memory/2856-1-0x0000000140000000-0x0000000140AA9000-memory.dmp	themida
behavioral2/memory/2856-3-0x0000000140000000-0x0000000140AA9000-memory.dmp	themida
behavioral2/memory/2856-4-0x0000000140000000-0x0000000140AA9000-memory.dmp	themida
behavioral2/memory/2856-2-0x0000000140000000-0x0000000140AA9000-memory.dmp	themida
behavioral2/memory/2856-6-0x0000000140000000-0x0000000140AA9000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AppleCleaner (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2856	AppleCleaner (1).exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5748	taskkill.exe
1484	taskkill.exe
5740	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	taskkill.exe
Token: SeDebugPrivilege	5740	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2856	AppleCleaner (1).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 5748	2856	AppleCleaner (1).exe	89
PID 2856 wrote to memory of 5740	2856	AppleCleaner (1).exe	90
PID 2856 wrote to memory of 1484	2856	AppleCleaner (1).exe	92

C:\Users\Admin\AppData\Local\Temp\AppleCleaner (1).exe
"C:\Users\Admin\AppData\Local\Temp\AppleCleaner (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5748
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5740
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im Battle.net.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-0-0x0000000140000000-0x0000000140AA9000-memory.dmp

Download

memory/2856-1-0x0000000140000000-0x0000000140AA9000-memory.dmp

Download

memory/2856-3-0x0000000140000000-0x0000000140AA9000-memory.dmp

Download

memory/2856-4-0x0000000140000000-0x0000000140AA9000-memory.dmp

Download

memory/2856-2-0x0000000140000000-0x0000000140AA9000-memory.dmp

Download

memory/2856-6-0x0000000140000000-0x0000000140AA9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads