Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
- Size 3.9MB
- Sample260708-fdpr2aa13y
- SHA256 47f5faf151663a95c02607099be536e178744db56264e139e36856cd861e5aa1
- MD5 3dbf435b704383c5b687ff1e423c0c4b
- SHA1 22e0e3db24314e3e512117249fb0260993ab4f93
- SHA512 dd1287bf2934a0d01f15f62a23ead49b6344625daea4b31f1a9552ffdb4fd457cc5082e7c7dcc732c7a2418206ac6ffa3e5c3fff44828cb3091008879df43ae7
- SSDEEP 98304:uBmD33+PnVs9q8SdeF0e5SMekVMJ+7yisVCwksakV:Qm73A8Ss5SMekVMJ+7yi8Cv1kV
- TLSH T189169D27A3E801EAC0B7C1B8CA578723E772B4591375A7DF16E086562F236E15E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steambooster = "\"c:\\users\\admin\\appdata\\local\\steambooster\\steambooster.exe\" --autostart" 2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
pid Process 4508 steambooster.exe 1600 steambooster.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\IconUri = "C:\\Users\\Admin\\AppData\\Local\\steambooster\\app-icon.ico" steambooster.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\ShowInSettings = "1" steambooster.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\SteamBalance.SteamBooster steambooster.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\DisplayName = "SteamBooster" steambooster.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe 1600 steambooster.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3760 wrote to memory of 1600 3760 2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_3dbf435b704383c5b687ff1e423c0c4b_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe" --parent-pid=3760 --bootstrap-handoff2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1600
-
-
\??\c:\users\admin\appdata\local\steambooster\steambooster.exe"c:\users\admin\appdata\local\steambooster\steambooster.exe" --autostart1⤵
- Executes dropped EXE
PID:4508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-07-08.log
- Size 1KB
- SHA256 13db2f0161dcd4cbaf4e7ccefd8f24b5dd3d5d305cfdc5bcdf0f749df7db2cfb
- MD5 a7a86a0beacee6c6d2e32529e6c8639e
- SHA1 580b2b56b8d6008d289f58d77ebc55bdbe338d77
- SHA512 c26a4f1f0d2c908798de755054444eb47d0ac96daf0055e1c09607bfcb42defd85423daabb25270875be00f6894e6b34d9f0e919bcc60a7b152d561f389a968d
- TLSH T17A21566A4E1E78736F224A12DC632B44E492F032EC95A0F4BBE61E084313907CFE1E57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\steambooster.exe
- Size 3.9MB
- SHA256 47f5faf151663a95c02607099be536e178744db56264e139e36856cd861e5aa1
- MD5 3dbf435b704383c5b687ff1e423c0c4b
- SHA1 22e0e3db24314e3e512117249fb0260993ab4f93
- SHA512 dd1287bf2934a0d01f15f62a23ead49b6344625daea4b31f1a9552ffdb4fd457cc5082e7c7dcc732c7a2418206ac6ffa3e5c3fff44828cb3091008879df43ae7
- SSDEEP 98304:uBmD33+PnVs9q8SdeF0e5SMekVMJ+7yisVCwksakV:Qm73A8Ss5SMekVMJ+7yi8Cv1kV
- TLSH T189169D27A3E801EAC0B7C1B8CA578723E772B4591375A7DF16E086562F236E15E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 d88bd939fc24d7f5285f0e6c3c9c1ded5d8b77a07700be6c2a7cf151fbd6560d
- MD5 cbe1d24bd00e9b25658cdd97280ef8fd
- SHA1 daaf21c99ac22b21abec125890084842800c209b
- SHA512 44dd4dc5db9e14f6c4d793e9db1d9d0da7f9003ba8b1bf8d727dffd409c07c6edfb2fc9b5826e053ad8587e40cc73ccf79559827788e80576a8088c11501e6d1
- TLSH T18F41650095FE5B54D3BACDB954F342628530B8B1AE4BEB1D430982CC2D31A25BE26F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\Удалить SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 2a3e495f147811f249e417873c5ad3772634954cf62bc23f2cdc1d25723298d3
- MD5 4ae94c24189189337853703156f208b3
- SHA1 4e35791aa80a352ebfe1a535667a241fd86324df
- SHA512 9ba496273e2876d355e48b621e67417be75950fcb34c16e1e08416f85033a32dd06e5c5ab7558d3f01d0e29da8521da9445b5c766d5d56d6ab5e57168eae31ff
- TLSH T15141450095EE1A54D3B7DDB965F242928670BCB1AE4BAB1D430982CC2D31A15BE26F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\SteamBooster.lnk
- Size 2KB
- SHA256 46e69b964a5823ec0cabc7d36a2d669e632e197d2461347360ad94a510bf8144
- MD5 f253ed5fbbcbf571db941d1eed43b271
- SHA1 7f8ba9868901d65e7ff75bbe55f9ece33877f53c
- SHA512 47d7ba27284f4f729cef6395bf3907b53fe8eb2902303a38548b62e2cd35b9766e37a34160d1a630948b79536826b01d76d519ad4f9791dde45ac21d49e2d745
- TLSH T16B41570095FE5654D3BBDDB955F342528530B8B1AE0BEA1D4349828C2D31E21BE27B1B
- MD5 SHA1 SHA512 TLSH