Overview

overview

7

Static

static

3

st-setup-1.8.30.exe

windows10-2004-x64

7

st-setup-1.8.30.exe

windows11-21h2-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows11-21h2-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows10-2004-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

Qt5Core.dll

windows10-2004-x64

1

Qt5Core.dll

windows11-21h2-x64

1

Qt5Gui.dll

windows10-2004-x64

1

Qt5Gui.dll

windows11-21h2-x64

1

Qt5Network.dll

windows10-2004-x64

1

Qt5Network.dll

windows11-21h2-x64

1

Qt5Svg.dll

windows10-2004-x64

1

Qt5Svg.dll

windows11-21h2-x64

1

Qt5Widgets.dll

windows10-2004-x64

1

Qt5Widgets.dll

windows11-21h2-x64

1

SteamTools.exe

windows10-2004-x64

1

SteamTools.exe

windows11-21h2-x64

1

imageformats/qico.dll

windows10-2004-x64

1

imageformats/qico.dll

windows11-21h2-x64

1

msvcp140.dll

windows10-2004-x64

1

msvcp140.dll

windows11-21h2-x64

1

msvcp140_1.dll

windows10-2004-x64

1

msvcp140_1.dll

windows11-21h2-x64

1

platforms/...ws.dll

windows10-2004-x64

1

platforms/...ws.dll

windows11-21h2-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-21h2-x64

1

Analysis

  • geolocation tags

    brbrazilsouth-america
  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 15:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    st-setup-1.8.30.exe
  • Size 10.6MB
  • Sample260511-s68f3ahs3j
  • SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 15 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe
    "C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
      2⤵
      • Modifies file permissions
      PID:5212
    • C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
      2⤵
      • Modifies file permissions
      PID:2080
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
      2⤵
        PID:2832
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Program Files\SteamTools\SteamTools.exe
        "C:\Program Files\SteamTools\SteamTools.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3776
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\StartInstall.wmf"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3312
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
      1⤵
        PID:4116
      • C:\Program Files\SteamTools\SteamTools.exe
        "C:\Program Files\SteamTools\SteamTools.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1408

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Core.dll
            • Path C:\Program Files\SteamTools\Core.dll
            • Size 657KB
            • SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Core.dll
            • Path C:\Program Files\SteamTools\Qt5Core.dll
            • Size 5.7MB
            • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Gui.dll
            • Path C:\Program Files\SteamTools\Qt5Gui.dll
            • Size 6.7MB
            • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Network.dll
            • Path C:\Program Files\SteamTools\Qt5Network.dll
            • Size 1.3MB
            • SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Svg.dll
            • Path C:\Program Files\SteamTools\Qt5Svg.dll
            • Size 322KB
            • SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Widgets.dll
            • Path C:\Program Files\SteamTools\Qt5Widgets.dll
            • Size 5.2MB
            • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SteamTools.exe
            • Path C:\Program Files\SteamTools\SteamTools.exe
            • Size 1.7MB
            • SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qico.dll
            • Path C:\Program Files\SteamTools\imageformats\qico.dll
            • Size 37KB
            • SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.dll
            • Path C:\Program Files\SteamTools\msvcp140.dll
            • Size 612KB
            • SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140_1.dll
            • Path C:\Program Files\SteamTools\msvcp140_1.dll
            • Size 30KB
            • SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qwindows.dll
            • Path C:\Program Files\SteamTools\platforms\qwindows.dll
            • Size 1.4MB
            • SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Program Files\SteamTools\vcruntime140.dll
            • Size 83KB
            • SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Program Files\SteamTools\vcruntime140_1.dll
            • Size 43KB
            • SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsg6137.tmp\System.dll
            • Size 12KB
            • SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsg6137.tmp\modern-wizard.bmp
            • Size 150KB
            • SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsg6137.tmp\nsDialogs.dll
            • Size 10KB
            • SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsg6137.tmp\nsExec.dll
            • Size 6KB
            • SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1408-90-0x00007FFC9CA30000-0x00007FFC9CF71000-memory.dmp
            Download

            memory/3776-76-0x00007FFC9CA30000-0x00007FFC9CF71000-memory.dmp
            Download

            memory/4524-18-0x00007FFCAE7E0000-0x00007FFCAE7E7000-memory.dmp
            Download

            memory/4524-17-0x00007FFCAE7E5000-0x00007FFCAE7E6000-memory.dmp
            Download