Analysis
- user interaction
yes - max time kernel
46s - max time network
47s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/06/2026, 16:06
General
- Target Steam Account Generator/SteamAccCreator.exe
- Size 182KB
- Sample260603-tj5bkabv21
- SHA256 af8391284e328f9637a8ae6ff5a47fb41e7999ee326afc34377c9e4f5a348f78
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Windows directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Steam Account Generator\SteamAccCreator.exe"C:\Users\Admin\AppData\Local\Temp\Steam Account Generator\SteamAccCreator.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Steam Account Generator\data\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Steam Account Generator\data\Launcher.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Steam Account Generator\data\softSteam.exe"C:\Users\Admin\AppData\Local\Temp\Steam Account Generator\data\softSteam.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 22963⤵
- Program crash
-
-
-
C:\Windows\IMF\Windows Services.exeC:\Windows\IMF\WINDOW~1.EXE1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5868 -ip 58681⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wqja0sxy.ifj.ps1
CaptchaHelper.dll
Runtime Explorer.exe
Secure System Shell.exe
Windows Services.exe
memory/1548-89-0x0000000000B20000-0x0000000000B32000-memory.dmp
memory/3824-99-0x0000000000BE0000-0x0000000000BF2000-memory.dmp
memory/5164-10-0x0000000000D60000-0x0000000000D70000-memory.dmp
memory/5164-63-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/5164-9-0x0000000006600000-0x000000000667E000-memory.dmp
memory/5164-8-0x0000000000D60000-0x0000000000D70000-memory.dmp
memory/5164-7-0x0000000000210000-0x0000000000224000-memory.dmp
memory/5164-62-0x0000000005DC0000-0x0000000005E36000-memory.dmp
memory/5868-110-0x000000006F560000-0x000000006FB22000-memory.dmp
memory/5868-36-0x000000006F560000-0x000000006FB22000-memory.dmp
memory/5868-40-0x0000000008E70000-0x0000000008EB8000-memory.dmp
memory/5868-112-0x000000006F560000-0x000000006FB22000-memory.dmp
memory/5868-39-0x00000000056B0000-0x0000000005712000-memory.dmp
memory/5868-25-0x0000000000200000-0x000000000094C000-memory.dmp
memory/5868-114-0x000000006F560000-0x000000006FB22000-memory.dmp
memory/5868-34-0x000000006F560000-0x000000006FB22000-memory.dmp
memory/5868-38-0x00000000739A0000-0x0000000073A29000-memory.dmp
memory/5868-37-0x000000006F560000-0x000000006FB22000-memory.dmp
memory/6040-12-0x0000000004EC0000-0x00000000054E8000-memory.dmp
memory/6040-97-0x00000000070B0000-0x00000000070C1000-memory.dmp
memory/6040-35-0x0000000005C10000-0x0000000005C5C000-memory.dmp
memory/6040-23-0x0000000005560000-0x00000000058B4000-memory.dmp
memory/6040-15-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/6040-14-0x0000000004D70000-0x0000000004DD6000-memory.dmp
memory/6040-13-0x0000000004CA0000-0x0000000004CC2000-memory.dmp
memory/6040-106-0x00000000071D0000-0x00000000071D8000-memory.dmp
memory/6040-11-0x0000000002230000-0x0000000002266000-memory.dmp
memory/6040-105-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/6040-65-0x000000006F510000-0x000000006F55C000-memory.dmp
memory/6040-64-0x0000000006130000-0x0000000006162000-memory.dmp
memory/6040-73-0x0000000004910000-0x000000000492E000-memory.dmp
memory/6040-84-0x0000000006B30000-0x0000000006BD3000-memory.dmp
memory/6040-103-0x00000000070F0000-0x0000000007104000-memory.dmp
memory/6040-90-0x0000000007500000-0x0000000007B7A000-memory.dmp
memory/6040-91-0x0000000006EB0000-0x0000000006ECA000-memory.dmp
memory/6040-92-0x0000000006F20000-0x0000000006F2A000-memory.dmp
memory/6040-93-0x0000000007130000-0x00000000071C6000-memory.dmp
memory/6040-33-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/6040-102-0x00000000070E0000-0x00000000070EE000-memory.dmp
memory/6044-4-0x0000000005740000-0x0000000005750000-memory.dmp
memory/6044-5-0x0000000005790000-0x000000000579A000-memory.dmp
memory/6044-6-0x00000000059A0000-0x00000000059F6000-memory.dmp
memory/6044-0-0x0000000000CB0000-0x0000000000CE4000-memory.dmp
memory/6044-3-0x0000000005810000-0x00000000058A2000-memory.dmp
memory/6044-2-0x0000000005D20000-0x00000000062C4000-memory.dmp
memory/6044-1-0x0000000005650000-0x00000000056EC000-memory.dmp