Overview
overview
3Static
static
3ExamplePlugin.zip
windows11-21h2-x64
1ExamplePlu...csproj
windows11-21h2-x64
3ExamplePlugin/Main.cs
windows11-21h2-x64
3ExamplePlu...nfo.cs
windows11-21h2-x64
3Plugins/Ex...in.dll
windows11-21h2-x64
3Plugins/Sh...sm.dll
windows11-21h2-x64
1Plugins/St...PI.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
1Plugins/St...86.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
3Plugins/St...64.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
3Plugins/St...64.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
3Steamless.CLI.exe
windows11-21h2-x64
3Steamless....config
windows11-21h2-x64
3Steamless.exe
windows11-21h2-x64
3Steamless.exe.config
windows11-21h2-x64
3Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/07/2026, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
ExamplePlugin.zip
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
ExamplePlugin/ExamplePlugin.csproj
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
ExamplePlugin/Main.cs
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
ExamplePlugin/Properties/AssemblyInfo.cs
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Plugins/ExamplePlugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
Plugins/SharpDisasm.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
Plugins/Steamless.API.dll
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
Plugins/Steamless.Unpacker.Variant10.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
Plugins/Steamless.Unpacker.Variant20.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
Plugins/Steamless.Unpacker.Variant21.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
Plugins/Steamless.Unpacker.Variant30.x64.dll
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
Plugins/Steamless.Unpacker.Variant30.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
Plugins/Steamless.Unpacker.Variant31.x64.dll
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
Plugins/Steamless.Unpacker.Variant31.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
Steamless.CLI.exe
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
Steamless.CLI.exe.config
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
Steamless.exe
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
Steamless.exe.config
Resource
win11-20260513-en
General
- Target ExamplePlugin/ExamplePlugin.csproj
- Size 2KB
- Sample260701-d3grlsfv3w
- SHA256 aa2d20fdeb689df617def139b55ecaec031d1192c9b3edcda336563d55cb42cb
- MD5 8de33f2ecb84331627c02232764462ca
- SHA1 3b04675febd3c8c10cd08ec0c23f85cb2227c60d
- SHA512 2f331866844dadaf63c37383ac59098bf562b6a248c04f1a653c03ac9a86c7f76141d31c346ae5cc6f27cd74d4a1f97e4bf687599277a64b19380099388108f3
- TLSH T18F514031D1C86DEA03F1643291E3AF4ADA79A3F314A08C68B7A9E44B0B33A941013737
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3024 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ExamplePlugin\ExamplePlugin.csproj1⤵
- Modifies registry class
PID:872
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3024