Overview
overview
3Static
static
3ExamplePlugin.zip
windows11-21h2-x64
1ExamplePlu...csproj
windows11-21h2-x64
3ExamplePlugin/Main.cs
windows11-21h2-x64
3ExamplePlu...nfo.cs
windows11-21h2-x64
3Plugins/Ex...in.dll
windows11-21h2-x64
3Plugins/Sh...sm.dll
windows11-21h2-x64
1Plugins/St...PI.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
1Plugins/St...86.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
3Plugins/St...64.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
3Plugins/St...64.dll
windows11-21h2-x64
3Plugins/St...86.dll
windows11-21h2-x64
3Steamless.CLI.exe
windows11-21h2-x64
3Steamless....config
windows11-21h2-x64
3Steamless.exe
windows11-21h2-x64
3Steamless.exe.config
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/07/2026, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
ExamplePlugin.zip
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
ExamplePlugin/ExamplePlugin.csproj
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
ExamplePlugin/Main.cs
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
ExamplePlugin/Properties/AssemblyInfo.cs
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Plugins/ExamplePlugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
Plugins/SharpDisasm.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
Plugins/Steamless.API.dll
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
Plugins/Steamless.Unpacker.Variant10.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
Plugins/Steamless.Unpacker.Variant20.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
Plugins/Steamless.Unpacker.Variant21.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
Plugins/Steamless.Unpacker.Variant30.x64.dll
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
Plugins/Steamless.Unpacker.Variant30.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
Plugins/Steamless.Unpacker.Variant31.x64.dll
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
Plugins/Steamless.Unpacker.Variant31.x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
Steamless.CLI.exe
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
Steamless.CLI.exe.config
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
Steamless.exe
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
Steamless.exe.config
Resource
win11-20260513-en
General
- Target ExamplePlugin/Properties/AssemblyInfo.cs
- Size 1KB
- Sample260701-d3grlsfv3w
- SHA256 1a109a070135a1bb660e92db5078c50df5b57e591237f6d9eb13f803a70b7724
- MD5 534df18dec72839f22f3688fe13b4288
- SHA1 4414a40dd2bc716fab6f3b092ce87e30450bf59b
- SHA512 cc18ec027ff14565f134201c5666bcf316c2209edba80d209525212dca0be14e7bbc8c9124ba00664558e93ec30f264dc52a13c4d69387ac3c7ee6850d8bd812
- TLSH T15A410D2D5245532E5FA101B3AE6378CEF10F332611DA1C2574FC6583FF615684378E96
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2416 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ExamplePlugin\Properties\AssemblyInfo.cs1⤵
- Modifies registry class
PID:5112
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2416