Resubmissions

23/11/2025, 02:32

251123-c1f7matkgm6

20/09/2025, 00:22

250920-apehjsaq2s8

17/09/2025, 22:01

250917-1xbpqsej2t8

17/09/2025, 21:56

250917-1tmmtsdr5z6

16/09/2025, 23:16

250916-288dhsbr216

16/09/2025, 23:00

250916-2y2g8a1zhw6

12/09/2025, 03:36

250912-d52vkafn3s7

14/04/2025, 18:37

250414-w9yb2sxmx37

14/04/2025, 18:37

250414-w9fr1axsfx1

14/04/2025, 18:36

250414-w9ejyaxsfv

Analysis

  • max time kernel
    900s
  • max time network
    592s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/09/2025, 23:16

General

  • Target
    SteamTools.exe
  • Size 1.7MB
  • Sample250916-288dhsbr21
  • SHA256 7afcb8d488f34e284deef1559dbc0d46d1bd68e226928e5b583169a1fd275842
  • MD5 SHA1 SHA512 SSDEEP
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SteamTools.exe
    "C:\Users\Admin\AppData\Local\Temp\SteamTools.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:5012

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/5012-1-0x0000029D56180000-0x0000029D56190000-memory.dmp

        memory/5012-0-0x00007FFB924B0000-0x00007FFB929F1000-memory.dmp

        memory/5012-2-0x0000029D55A50000-0x0000029D5610B000-memory.dmp

        memory/5012-4-0x0000029D55A50000-0x0000029D5610B000-memory.dmp

        memory/5012-7-0x0000029D55A50000-0x0000029D5610B000-memory.dmp

        memory/5012-8-0x0000029D55A50000-0x0000029D5610B000-memory.dmp

        memory/5012-9-0x0000029D55A50000-0x0000029D5610B000-memory.dmp

        memory/5012-61-0x0000029D55A50000-0x0000029D5610B000-memory.dmp