Analysis
- user interaction
yes - max time kernel
600s - max time network
460s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 04:16
General
- Target appleclientbeta.exe
- Size 9.1MB
- Sample260831-ev1eesw1fv
- SHA256 a8da91f7982a9dd21e589eca8ea1581d5c8b89ea8cb6d627e55932897c7eecd7
Malware Config
Signatures
- Loads dropped DLL 16 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\appleclientbeta.exe"C:\Users\Admin\AppData\Local\Temp\appleclientbeta.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\appleclientbeta.exe"C:\Users\Admin\AppData\Local\Temp\appleclientbeta.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python314.dll
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_ggzi032p.4ed.ps1
memory/4188-98-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-111-0x000001C0F3560000-0x000001C0F3612000-memory.dmp
memory/4188-99-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-100-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-101-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-102-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-103-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-104-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-105-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-106-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-107-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-97-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-110-0x000001C0F3540000-0x000001C0F355E000-memory.dmp
memory/4188-112-0x000001C0F3520000-0x000001C0F352A000-memory.dmp
memory/4188-114-0x000001C0F3650000-0x000001C0F3674000-memory.dmp
memory/4188-113-0x000001C0F3650000-0x000001C0F367A000-memory.dmp
memory/4188-116-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-96-0x000001C0F2F20000-0x000001C0F2F42000-memory.dmp
memory/4188-93-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-122-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp
memory/4188-92-0x00007FFCF504F000-0x00007FFCF5050000-memory.dmp
memory/4188-126-0x00007FFCF4EC0000-0x00007FFCF5864000-memory.dmp