6910fa848124f4858c8a3c97f0348556be9f46360845a39046ed337288dcdea3

Analysis

max time kernel
898s
max time network
383s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/03/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldclient/steam_settings/configs.user.ini
Size 220B
Sample260308-vysfzset3p
SHA256 6910fa848124f4858c8a3c97f0348556be9f46360845a39046ed337288dcdea3
MD5 9026ea52b22c80bf7c6e5fb4dda04324
SHA1 5a07926d7a5e9f4ec538b48315b56d0130540c21
SHA512 4f8d8746c0926419e38c893aae78d988f9ffba45dcbe52da3470fe0640f966078a88636b084e2d87c4471f78dc056a7c0eb78cf0d97a1812c1bda3d7af8da52e
TLSH
T1D4D0228E0E0002A22FB3038832E8C3EF0B0EC2E88C800AFE28E2A3820020CC00028B00
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4812	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\coldclient\steam_settings\configs.user.ini
1⤵
- Modifies registry class
PID:3640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3640-0-0x000001F5BF860000-0x000001F5BF8BD000-memory.dmp

Download

memory/4812-1-0x0000028E55260000-0x0000028E552BD000-memory.dmp