Analysis
- user interaction
yes - max time kernel
114s - max time network
110s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SteamLuaPatcher.exe
Resource
win10v2004-20260130-en
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
SteamLuaPatcher.exe
Resource
win11-20260130-en
4 signatures
900 seconds
General
- Target SteamLuaPatcher.exe
- Size 17.7MB
- Sample260422-24v8dsdx61
- SHA256 e55592d2d0a88d993ddc644cd44749a960731c0742ae50f24825e08be21a702e
- MD5 f2065a6e5c2a2d5e665c159815146c34
- SHA1 65087a3062cae1e28e4295354cc3d2ee209231f5
- SHA512 5ed368b4006bd864519ac3b261e1eb6076f9f04c88cb4a20bc019b116e81487e16993580b14b2991056f1ebd31138286f25dd841b9746be5b9d55eb5c34f7c9a
- SSDEEP 393216:WF40W9xOr1vTbFqkPqw9WZ0uhLKFdu9CwJsv6tJt6:44WRw/U
- TLSH T15C178D1762E401D4D57AC0398B279507EBB1B40A03B4ABDB21A096D62F77FF12E7E325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Steam\config\stplug-in\684410.lua SteamLuaPatcher.exe File created C:\Program Files (x86)\Steam\config\stplug-in\684410.lua SteamLuaPatcher.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4424 SteamLuaPatcher.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4424 SteamLuaPatcher.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4424 SteamLuaPatcher.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\SteamLuaPatcher\SteamLuaPatcher\684410.lua
- Size 528B
- SHA256 5626467e7ca3e1a784bd0b3e6e1c1930c4ea3d2605e1cecc5932d969afcad679
- MD5 8fc3111a412c3e74234a4141e05991cc
- SHA1 fb7edab72fa721d0a89875dd15678d28474f6771
- SHA512 400abfcb45d78d33cb034366fdcc9f5181c6e3121e3e839ec871cd28484d094a40be0ba2a4c3c04996fca3a3eab7df4bdfc8d668dde1e809a6e8ccd5f4c767ac
- TLSH T182F05952DF3476056758454E2C5B8631255F80C9F28FE3F0DC0AFEC936D29295A1150F
- MD5 SHA1 SHA512 TLSH