0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 16:04

Target
luatools/backend/restart_steam.cmd
Size 532B
Sample260620-th1a8ag17x
SHA256 0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e
MD5 21b7509230737e6d588e450c1056ce7c
SHA1 c57c7220578e542f249bbade1dc4cf6e4dff3508
SHA512 6b2152e412869e99637b6fc06e4f58aa573ef1ce0803690ea7629903d83dab731c969027bed7b5fdf212f7819066f40e27d43c3f5db82892e52215124fde3b04
TLSH
T1E6F0C900EC022835AFE853B6ED051177AB5BE513400E1DD2929B45A0A8297CA25F68BD
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2240	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4404	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	taskkill.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 5512	856	cmd.exe	89
PID 5512 wrote to memory of 1988	5512	cmd.exe	90
PID 5512 wrote to memory of 3860	5512	cmd.exe	91
PID 856 wrote to memory of 4404	856	cmd.exe	92
PID 856 wrote to memory of 2240	856	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\luatools\backend\restart_steam.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul | find "SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:1988
- - C:\Windows\system32\find.exe
    find "SteamPath"
    3⤵
    PID:3860
- C:\Windows\system32\taskkill.exe
  taskkill /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2240