Analysis
- user interaction
yes - max time kernel
13s - max time network
17s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 09:28
General
- Target SteamAuth++.exe
- Size 62.8MB
- Sample260418-lfpspsb17s
- SHA256 f1defa7361498d2c45ff9fead52b2a42e4f85d7df9dc2a1e7e7b9d339b9a5277
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SteamAuth++.exe"C:\Users\Admin\AppData\Local\Temp\SteamAuth++.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SteamAuth++.exe --webview-exe-version="0.2.5-alpha free build" --user-data-dir="C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3840.5672.107911321579733424082⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffcd2c2b078,0x7ffcd2c2b084,0x7ffcd2c2b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView" --webview-exe-name=SteamAuth++.exe --webview-exe-version="0.2.5-alpha free build" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,16965371473079993145,14073343358009769108,262144 --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView" --webview-exe-name=SteamAuth++.exe --webview-exe-version="0.2.5-alpha free build" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2024,i,16965371473079993145,14073343358009769108,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView" --webview-exe-name=SteamAuth++.exe --webview-exe-version="0.2.5-alpha free build" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2348,i,16965371473079993145,14073343358009769108,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SteamAuth\WebView2\EBWebView" --webview-exe-name=SteamAuth++.exe --webview-exe-version="0.2.5-alpha free build" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3556,i,16965371473079993145,14073343358009769108,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:13⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
throttle_store.dat
data_0
data_1
data_2
data_3
MANIFEST-000001
SCT Auditing Pending Reports
CURRENT
Local State
Local State
Local State
Local State~RFe58273a.TMP
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
WebView2Loader.dll
wpfgfx_cor3.dll
memory/3840-127-0x0000029377830000-0x0000029377880000-memory.dmp
memory/3840-91-0x00000252DD670000-0x00000252DD6A0000-memory.dmp
memory/3840-32-0x0000029373960000-0x00000293741A0000-memory.dmp
memory/3840-95-0x0000029375F50000-0x0000029375FF0000-memory.dmp
memory/3840-99-0x00000293773A0000-0x00000293775B0000-memory.dmp
memory/3840-103-0x00000293770B0000-0x0000029377100000-memory.dmp
memory/3840-119-0x00000293760F0000-0x0000029376110000-memory.dmp
memory/3840-123-0x0000029377170000-0x0000029377190000-memory.dmp
memory/3840-115-0x0000029377670000-0x0000029377730000-memory.dmp
memory/3840-111-0x0000029377100000-0x0000029377130000-memory.dmp
memory/3840-107-0x00000252D7CC0000-0x00000252D7CD0000-memory.dmp
memory/3840-135-0x0000029378560000-0x0000029378660000-memory.dmp
memory/3840-143-0x00000293778D0000-0x0000029377910000-memory.dmp
memory/3840-139-0x0000029378900000-0x0000029378AC0000-memory.dmp
memory/3840-131-0x0000029377880000-0x00000293778A0000-memory.dmp
memory/3840-10-0x00000252DACA0000-0x00000252DBB30000-memory.dmp
memory/3840-147-0x0000029378E70000-0x0000029378EE0000-memory.dmp
memory/3840-151-0x0000029378FF0000-0x0000029379060000-memory.dmp
memory/3840-44-0x00000252D7E40000-0x00000252D7E50000-memory.dmp
memory/3840-56-0x00000252DD2A0000-0x00000252DD2C0000-memory.dmp
memory/3840-160-0x000002937B2C0000-0x000002937B2D0000-memory.dmp
memory/3840-164-0x000002937BF10000-0x000002937BF20000-memory.dmp
memory/3840-168-0x000002937C040000-0x000002937C0F0000-memory.dmp
memory/3840-172-0x000002937C180000-0x000002937C210000-memory.dmp
memory/3840-178-0x000002937BF60000-0x000002937BF80000-memory.dmp
memory/3840-36-0x00000252D7F00000-0x00000252D7F20000-memory.dmp
memory/3840-182-0x000002937CEC0000-0x000002937CEF0000-memory.dmp
memory/3840-186-0x000002937BEC0000-0x000002937BEE0000-memory.dmp
memory/3840-60-0x00000252DD2C0000-0x00000252DD310000-memory.dmp
memory/3840-64-0x00000252DD590000-0x00000252DD5B0000-memory.dmp
memory/3840-195-0x000002937D350000-0x000002937D380000-memory.dmp
memory/3840-199-0x000002937D740000-0x000002937D900000-memory.dmp
memory/3840-407-0x0000029378660000-0x000002937870D000-memory.dmp
memory/3840-79-0x0000029375CC0000-0x0000029375DD0000-memory.dmp
memory/3840-87-0x0000029376920000-0x00000293770B0000-memory.dmp
memory/3840-83-0x0000029375DD0000-0x0000029375E20000-memory.dmp
memory/3840-68-0x00000252DD620000-0x00000252DD650000-memory.dmp
memory/3840-72-0x00000252DD5D0000-0x00000252DD5F0000-memory.dmp
memory/3840-48-0x00000252D9C80000-0x00000252D9CA0000-memory.dmp
memory/3840-408-0x0000029378440000-0x0000029378448000-memory.dmp
memory/3840-16-0x00000252DBD60000-0x00000252DBF80000-memory.dmp
memory/3840-52-0x00000252DD150000-0x00000252DD170000-memory.dmp
memory/3840-40-0x00000252DD220000-0x00000252DD2A0000-memory.dmp
memory/3840-28-0x00000252DC170000-0x00000252DC1B0000-memory.dmp
memory/3840-24-0x00000252DC0E0000-0x00000252DC130000-memory.dmp
memory/3840-20-0x00000252DBF80000-0x00000252DC0E0000-memory.dmp
memory/3840-12-0x00000293721C0000-0x0000029373120000-memory.dmp
memory/3972-224-0x00007FFCEEBF0000-0x00007FFCEEBF1000-memory.dmp
memory/5404-335-0x00007FFCEEBF0000-0x00007FFCEEBF1000-memory.dmp
memory/5776-247-0x00007FFCEEAA0000-0x00007FFCEEAA1000-memory.dmp
memory/5776-246-0x00007FFCEE960000-0x00007FFCEE961000-memory.dmp