Analysis
- max time kernel
40s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/10/2026, 22:54
General
- Target APInstaller.exe
- Size 3.1MB
- Sample261016-2vrtlsew71
- SHA256 77523254643f079099b736f638810571eccc80d1c8a99c07f540c5f9e150ac1f
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Loads dropped DLL 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\APInstaller.exe"C:\Users\Admin\AppData\Local\Temp\APInstaller.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SQLite.Interop.dll
memory/4352-14-0x0000000007120000-0x0000000007142000-memory.dmp
memory/4352-18-0x0000000005A40000-0x0000000005A48000-memory.dmp
memory/4352-8-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4352-9-0x0000000005990000-0x00000000059C4000-memory.dmp
memory/4352-11-0x0000000006D00000-0x0000000006D66000-memory.dmp
memory/4352-12-0x0000000006FB0000-0x0000000006FCA000-memory.dmp
memory/4352-13-0x0000000007010000-0x00000000070C0000-memory.dmp
memory/4352-0-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/4352-1-0x0000000000BA0000-0x0000000000EB2000-memory.dmp
memory/4352-15-0x0000000007160000-0x00000000074BB000-memory.dmp
memory/4352-17-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4352-19-0x00000000088F0000-0x0000000008918000-memory.dmp
memory/4352-20-0x0000000007C80000-0x0000000007C88000-memory.dmp
memory/4352-21-0x000000000AC00000-0x000000000AC08000-memory.dmp
memory/4352-22-0x000000000AC90000-0x000000000ACCE000-memory.dmp
memory/4352-23-0x000000000AC60000-0x000000000AC6E000-memory.dmp
memory/4352-24-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/4352-25-0x0000000074A70000-0x000000007522C000-memory.dmp