Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/06/2026, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
SteamBoosterSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SteamBoosterSetup.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target SteamBoosterSetup.exe
- Size 3.9MB
- Sample260627-vdhfaacv2m
- SHA256 09c4f8262c74179f6f9bf776866f8bc1873ed8ce6b5e258c03d30ea344ad7678
- MD5 cbeee5807322b86932dcd5c839d8f6bf
- SHA1 3ca16328f9efafbf8ea29529120450be1aa4f8ac
- SHA512 9aa07013a83ad73d7a89d9b8e6a92383d1bf6633cd1d19ea583deabeb65454b796b78fbc31fa5a1f33b1c79964fc3fc643d8a7b35c48ebecb3d3f5f575ede292
- SSDEEP 98304:cDz2a2xlwurTS4BO63iXhmoGlM7I1TnRZNpw3+Sq7:gz2a+SooXhmoGlM7I1TnHNS27
- TLSH T194169D27A7E801E9C0B7C1B8CA578723E772B4191375A7DF1AE08A561F236E15E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\Run\steambooster = "\"c:\\users\\admin\\appdata\\local\\steambooster\\steambooster.exe\" --autostart" SteamBoosterSetup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
pid Process 5808 steambooster.exe 2744 steambooster.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\AppUserModelId steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\DisplayName = "SteamBooster" steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\IconUri = "C:\\Users\\Admin\\AppData\\Local\\steambooster\\app-icon.ico" steambooster.exe Set value (int) \REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\ShowInSettings = "1" steambooster.exe Key created \REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\AppUserModelId\SteamBalance.SteamBooster steambooster.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe 2744 steambooster.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6084 wrote to memory of 2744 6084 SteamBoosterSetup.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\SteamBoosterSetup.exe"C:\Users\Admin\AppData\Local\Temp\SteamBoosterSetup.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\Temp\SteamBoosterSetup.exe" --parent-pid=6084 --bootstrap-handoff2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2744
-
-
\??\c:\users\admin\appdata\local\steambooster\steambooster.exe"c:\users\admin\appdata\local\steambooster\steambooster.exe" --autostart1⤵
- Executes dropped EXE
PID:5808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-06-27.log
- Size 1KB
- SHA256 637f0843ca978b7b57a3c6e7f9289f3b541034fbecc2b845411d86142f878529
- MD5 97fd6be4212f2b576413b971713820fe
- SHA1 f800e13958c2279aea6c178946f737ee0a6113bc
- SHA512 f4180353fa4eaac02515e8dffc12d86174ba95ae18abae2d6f13ca000e43032479e30219d68b7c3d67729aa28cab43a6e45bc047aa8594398663197038b35751
- TLSH T10621F2914DFBBA774F0E4A53DA43364D5015F532EDB6A0B87BE92C486A13D068FC1217
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\steambooster.exe
- Size 3.9MB
- SHA256 09c4f8262c74179f6f9bf776866f8bc1873ed8ce6b5e258c03d30ea344ad7678
- MD5 cbeee5807322b86932dcd5c839d8f6bf
- SHA1 3ca16328f9efafbf8ea29529120450be1aa4f8ac
- SHA512 9aa07013a83ad73d7a89d9b8e6a92383d1bf6633cd1d19ea583deabeb65454b796b78fbc31fa5a1f33b1c79964fc3fc643d8a7b35c48ebecb3d3f5f575ede292
- SSDEEP 98304:cDz2a2xlwurTS4BO63iXhmoGlM7I1TnRZNpw3+Sq7:gz2a+SooXhmoGlM7I1TnHNS27
- TLSH T194169D27A7E801E9C0B7C1B8CA578723E772B4191375A7DF1AE08A561F236E15E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 d57560d3b953f59ecffb5dcb8cfa5b15c54412d3c34c8c95acaf13077e73279a
- MD5 5a4da8ca425c3e98902bfae9a8f9709b
- SHA1 c11412efde0bb8ac0c48b9d13037f39d7d8a4a95
- SHA512 f9fa734dffb973d700cd5b2d063f58912dbaeb8994b167199ffd6e97531705f7568b380f9a096d91b698ff2a5665f066058f675acb5fc8a5aed9848ba6316a8c
- TLSH T1FB41AC1045ED1A51C37B8DB825B352659970B872BF0BDB1D034882CC0C25A24FE26F1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\Удалить SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 cfbb072c69412824b48c792fa205c016a650a4552cdbbfe972c8a175c40d4724
- MD5 ff563bddbfc3c06fa29f50eafe2100bd
- SHA1 40f0abc90e0a7a7993e4580bb5f0b780ec291950
- SHA512 d1b2acbc04dd6fe27f02136a65cb706e0d0321e742bd7849915787a5cf41e2de45fb89c940f18a580191396c8eff33f98cfe2dd96edde8e096b5f7287a8a142a
- TLSH T14341AA1055EE1A91C7778EB82AB256968970BC72BF0B9B1D030882CC0C25A14FE22F1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\SteamBooster.lnk
- Size 2KB
- SHA256 2fcbc6117ab479033d1f47b959ef8893a8345aad6316e5c922bf9cff3e846a78
- MD5 a68cb80d706ba6440bfa58c44df03afc
- SHA1 382e0e1b59c72a592cddc6fd6cadaf8c89bf59d4
- SHA512 f94c6dd91fa9540f1e4a19e5442764c7da64954ac0dddf7a5200f2b46bbec1e6f1c75cb7f722ee7c7c722fa3bfaaaf728bf7010cb56c6ea6c7dee0a18b75277c
- TLSH T1F341BC1055FD0A91C37B8DB82AB352569974B8727F0FDA1D4348828C0C31A24FE32B1F
- MD5 SHA1 SHA512 TLSH