Overview
overview
6Static
static
3SteamSetup.exe
windows11-21h2-x64
6$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3Steam.exe
windows11-21h2-x64
1bin/SteamService.exe
windows11-21h2-x64
1uninstall.exe
windows11-21h2-x64
4$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...nk.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
-
max time kernel
0s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-02-2024 18:31
Static task
static1
Behavioral task
behavioral1
Sample
SteamSetup.exe
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20231222-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20231215-en
Behavioral task
behavioral7
Sample
Steam.exe
Resource
win11-20231215-en
Behavioral task
behavioral8
Sample
bin/SteamService.exe
Resource
win11-20231215-en
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
win11-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ShellLink.dll
Resource
win11-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20231215-en
General
-
Target
$PLUGINSDIR/StdUtils.dll
-
Size
99KB
-
MD5
98a4efba4e4b566dc3d93d2d9bfcab58
-
SHA1
8c54ae9fcec30b2beea8b6af4ead0a76d634a536
-
SHA256
e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48
-
SHA512
2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0
-
SSDEEP
1536:Lyy+HcFWrX52XWcS15c4DBVOw/bEQvWt6uouMw5m0mhdBu4NpBTvO7Fvo6mVS6oN:Oy+8ozImcSNd1YHbMbC
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3088 1572 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4400 wrote to memory of 1572 4400 rundll32.exe rundll32.exe PID 4400 wrote to memory of 1572 4400 rundll32.exe rundll32.exe PID 4400 wrote to memory of 1572 4400 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#12⤵PID:1572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 5203⤵
- Program crash
PID:3088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1572 -ip 15721⤵PID:2296