Overview
overview
8Static
static
3GameOverla...er.dll
windows10-2004-x64
3GameOverla...er.dll
windows11-ltsc_2024-x64
3GameOverla...64.dll
windows10-2004-x64
1GameOverla...64.dll
windows11-ltsc_2024-x64
1Gunfire Re...64.dll
windows10-2004-x64
1Gunfire Re...64.dll
windows11-ltsc_2024-x64
8Launcher.exe
windows10-2004-x64
1Launcher.exe
windows11-ltsc_2024-x64
1steamclient.dll
windows10-2004-x64
3steamclient.dll
windows11-ltsc_2024-x64
3steamclient64.dll
windows10-2004-x64
1steamclient64.dll
windows11-ltsc_2024-x64
8Custom.dll
windows10-2004-x64
5Custom.dll
windows11-ltsc_2024-x64
5Gunfire Re...64.dll
windows10-2004-x64
1Gunfire Re...64.dll
windows11-ltsc_2024-x64
1OnlineFix.url
windows10-2004-x64
6OnlineFix.url
windows11-ltsc_2024-x64
6OnlineFix64.dll
windows10-2004-x64
1OnlineFix64.dll
windows11-ltsc_2024-x64
1SteamOverlay64.dll
windows10-2004-x64
1SteamOverlay64.dll
windows11-ltsc_2024-x64
1winmm.dll
windows10-2004-x64
1winmm.dll
windows11-ltsc_2024-x64
1Gunfire Re...82.exe
windows10-2004-x64
7Gunfire Re...82.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/06/2026, 16:49
Behavioral task
behavioral1
Sample
GameOverlayRenderer.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
GameOverlayRenderer.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral3
Sample
GameOverlayRenderer64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
GameOverlayRenderer64.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
Gunfire Reborn_Data/Plugins/steam_api64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Gunfire Reborn_Data/Plugins/steam_api64.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral7
Sample
Launcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Launcher.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral9
Sample
steamclient.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
steamclient.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral11
Sample
steamclient64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
steamclient64.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral13
Sample
Custom.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Custom.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral15
Sample
Gunfire Reborn_Data/Plugins/steam_api64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Gunfire Reborn_Data/Plugins/steam_api64.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral17
Sample
OnlineFix.url
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
OnlineFix.url
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral19
Sample
OnlineFix64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
OnlineFix64.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral21
Sample
SteamOverlay64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
SteamOverlay64.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral23
Sample
winmm.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
winmm.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral25
Sample
Gunfire Reborn Update from Build 20506329 to Build 22432082/Update/Gunfire Reborn Update to Build 22432082.exe
Resource
win10v2004-20260513-en
General
- Target steamclient.dll
- Size 14.3MB
- Sample260623-vbml8aev9z
- SHA256 55b6523d3e31819770bfc2a58d6a037c14c38c23eb2039e799d68ab008bc5011
- MD5 d13380b7d1a01adee821ec031e294140
- SHA1 187e7a40d7d6d395ff9251b4a35795311aed0f9c
- SHA512 3dc795467ea0b2d329f599a238e6961a73efcb831145eb0ff841875b4c66d45e2e4ee47ee4dfea9a2cddaf52519fb77344cc0feb5b9aef1ce371e692a2e4919f
- SSDEEP 196608:3Glq9KBFBNQaX0zhK5Ehr84hdR7wciZgA72D8UEAj:P9KnAK5p4hXwcIgA72IAj
- TLSH T1F8E6BF01F641D125FBBB01F28AFA477A5B3C9A70171147E7B2C4B6198E26AD1FD32623
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2000 wrote to memory of 5600 2000 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\steamclient.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\steamclient.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5600
-