e99ce44d26b63ef32d182e0b097d2cf9c630db281ad07472b6ae8f2ffc53bdc5

Analysis

max time kernel
152s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apex-windows-x64.exe
Size 127.5MB
Sample260722-yfn8dsbe96
SHA256 e99ce44d26b63ef32d182e0b097d2cf9c630db281ad07472b6ae8f2ffc53bdc5
MD5 66cc84b80061b764d58835600b4d522c
SHA1 02edfa0ce7fe368ef548ba7d5bc87bc99410469b
SHA512 13929b91050e65ef6e7ae72fd09340fdd76c1c6ace89195dfd8c4c1e7930f65674f4639f8a064072cd7079a32cb584c7726bc0f88cb188e85157ed1717ebfe7e
SSDEEP 786432:4MKVpL0NlvnOMVDLz9/W6PD3m6klrs9wbyfhbTCJOCfClX9jOF6XQymJx:4MKVSNV3z9/rmJAwbObT6ClX9j9Ay+x
TLSH
T19A588E03B2F71094E177D1349ADB5223A632BC071B34A9EB764C4B301F76AE497B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6848	powershell.exe
6716	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6848	powershell.exe
6848	powershell.exe
6716	powershell.exe
6716	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6848	powershell.exe
Token: SeDebugPrivilege	6716	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 6848	4404	apex-windows-x64.exe	90
PID 4404 wrote to memory of 6716	4404	apex-windows-x64.exe	91

C:\Users\Admin\AppData\Local\Temp\apex-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\apex-windows-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command [System.Runtime.Intrinsics.X86.Avx2]::IsSupported
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command [System.Runtime.Intrinsics.X86.Avx2]::IsSupported
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 12da3af07b18fbd08a83a803f22ebc70caf89cc1ba620d3cc781f30fad5671d5
MD5 40c61ee9414e1a5549f054dd0b46c7d8
SHA1 63d0410d4a045bf6814462e5201a604799ab5651
SHA512 60580e3d7d1344b204c02d88762a535f204d9ba2b4267f0f3680f403ae5621f13f0654a26572da060cf619c735954a1286308be27c8c707b30f2cf86dacc3c29
TLSH
T15F116633F3CC8624DC5A403610CEA91137B687CB40DECE6B7B84D154B82F685DF60260
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 b34595ebadfa2535de7b92df9e7d854f07cbab177492636c0ec22539158952c9
MD5 41b66a3902c4a87294a9bf6396d4d189
SHA1 b69495815dc75cd6de82bb40f73f5ba4ecc6936f
SHA512 1293f597aca975440a5769141ccb569ff4a5b7f8a8ffeb97bf389b81bf0edb8a4ecace1ba189c66cc37d4d8aac13727c4e536fb96a8f7513d6bb1d518a620179
SSDEEP 48:Nl8RtQGCRTUNLXdJFnukvhkvklCywMgDd/kH1YSdJhSogZot7RdfkH1YmdJhSogx:NGeGCuVXvFukvhkvCCtdktvQHqkJvQHX
TLSH
T199D1BC1017F64619E1BA8F7AACB5B720A235FC05AF16EBCE4240965DDC31621E83876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 9d9129e48d382eee053129410d1979393db76a65aabb505f28c2b8fd1a3f4ed9
MD5 5517b2af1147e44ce7748a43112fbe03
SHA1 37520e31a12e660939aee9b7ea85873553d1c223
SHA512 1f8e918a1d9b64306f168ac3f5b637c606bef68d4dfdf20e7ce272eb9dc3007fcb7458ff508b77f8f5c66a6b923a2983336f45beed849182b1dda28ba6e476b4
SSDEEP 48:Nl8jwf/qC+TUNaXdJFnukvhkvklCywMgDd/kH1YmdJhSogZot7RdfkH1YmdJhSoC:N3nqCNAXvFukvhkvCCtdkJvQHqkJvQHX
TLSH
T128D1CE1027F64615F1BA8F7A9C75B720A235FC05EF16EBCE4240966DDC32621E83876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6848-4-0x0000027ED6D40000-0x0000027ED6D62000-memory.dmp

Download