Overview
overview
6Static
static
1SteamSetup.exe
windows10-2004-x64
6$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3Steam.exe
windows10-2004-x64
5bin/SteamService.exe
windows10-2004-x64
1uninstall.exe
windows10-2004-x64
4$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nk.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
1387s -
max time network
1180s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-de -
resource tags
arch:x64arch:x86image:win10v2004-20240419-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
03-05-2024 16:22
Static task
static1
Behavioral task
behavioral1
Sample
SteamSetup.exe
Resource
win10v2004-20240419-de
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240419-de
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-de
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-de
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-de
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-de
Behavioral task
behavioral7
Sample
Steam.exe
Resource
win10v2004-20240419-de
Behavioral task
behavioral8
Sample
bin/SteamService.exe
Resource
win10v2004-20240419-de
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win10v2004-20240419-de
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-de
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ShellLink.dll
Resource
win10v2004-20240426-de
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-de
General
-
Target
$PLUGINSDIR/StdUtils.dll
-
Size
110KB
-
MD5
db11ab4828b429a987e7682e495c1810
-
SHA1
29c2c2069c4975c90789dc6d3677b4b650196561
-
SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376
-
SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88
-
SSDEEP
1536:cyy+HcFWrX52XWcS15c4DBVOw/bEQvWt6uouMw5m0mhdBu4NpBTvO7Fvo6mVS6oz:fy+8ozImcSNd1YHbMbCk/S
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 632 4576 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 412 wrote to memory of 4576 412 rundll32.exe rundll32.exe PID 412 wrote to memory of 4576 412 rundll32.exe rundll32.exe PID 412 wrote to memory of 4576 412 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 6163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 45761⤵