Overview

overview

7

Static

static

3

ApexData.exe

windows10-2004-x64

7

ApexData.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 03:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ApexData.exe
  • Size 5.1MB
  • Sample260731-dzb2ysam2w
  • SHA256 43f46c8c3c89b8386e72f7ff2350a77c2230cffdb8a7398c6e4236d46891665e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 9 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ApexData.exe
    "C:\Users\Admin\AppData\Local\Temp\ApexData.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\ApexDATA.exe
      "C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\ApexDATA.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c color 4
        3⤵
        • Executes a command shell one-liner
        PID:3276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:2768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im HTTPDebuggerUI.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im HTTPDebuggerSvc.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5960
        • C:\Windows\system32\sc.exe
          sc stop HTTPDebuggerPro
          4⤵
          • Launches sc.exe
          PID:4584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5972
        • C:\Windows\system32\taskkill.exe
          taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1228
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Windows\system32\taskkill.exe
          taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5944
        • C:\Windows\system32\taskkill.exe
          taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4760
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:396
    • C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\BrowserExtractor.exe
      "C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\BrowserExtractor.exe" --elevated --force-tg --skip-sbx
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4828

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ApexDATA.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\ApexDATA.exe
        • Size 613KB
        • SHA256 5321e5609325a133fa65ae1c118a864409a521223f7ec63c1227e15db0ce845b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BrowserExtractor.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\BrowserExtractor.exe
        • Size 1.8MB
        • SHA256 e2defa972d4daa5b751589c32077d915f37d00f012e82d1cd0c5ac438750d942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KernBridge.sys
        • Path C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\KernBridge.sys
        • Size 1.1MB
        • SHA256 24701d3e669db9da89269a0022f2289f217387eada9dfe21ce5ef13c2aed7c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ApexBrowserCombined\msvcp140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download