0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 16:04

Target
luatools/backend/restart_steam.cmd
Size 532B
Sample260620-th1a8ag17x
SHA256 0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e
MD5 21b7509230737e6d588e450c1056ce7c
SHA1 c57c7220578e542f249bbade1dc4cf6e4dff3508
SHA512 6b2152e412869e99637b6fc06e4f58aa573ef1ce0803690ea7629903d83dab731c969027bed7b5fdf212f7819066f40e27d43c3f5db82892e52215124fde3b04
TLSH
T1E6F0C900EC022835AFE853B6ED051177AB5BE513400E1DD2929B45A0A8297CA25F68BD
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4040	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3988	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	taskkill.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4728	4612	cmd.exe	85
PID 4728 wrote to memory of 4736	4728	cmd.exe	86
PID 4728 wrote to memory of 1028	4728	cmd.exe	87
PID 4612 wrote to memory of 3988	4612	cmd.exe	88
PID 4612 wrote to memory of 4040	4612	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\luatools\backend\restart_steam.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul | find "SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:4736
- - C:\Windows\system32\find.exe
    find "SteamPath"
    3⤵
    PID:1028
- C:\Windows\system32\taskkill.exe
  taskkill /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4040