Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
- Size 3.9MB
- Sample260715-e8l4ysew5s
- SHA256 d6b16075e80d0e820a5555ec6b644cd695916b14c7f6eec2c874f2f7ccaedeb3
- MD5 8e4011176f5c62bd227ae8972fd6013d
- SHA1 683f22d476819ae232f2305f7942bb103a694d1d
- SHA512 50717c03698f35cefe8d452d3a86146d0e8604ccc06c327853999e3a2d1d5c461c2a7a07debd118024dbc7f4cc4a5f285fc7d35405cb9d36e85dc558659522af
- SSDEEP 98304:1Dz2a2xlwurTS4BO63iXhmoGlM7I1TnRZNpw3+Sq:Bz2a+SooXhmoGlM7I1TnHNS2
- TLSH T17D169E27A7E801E9C0B7C1B8CA578723E772B4191375A7DF1AE08A561F236E15E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3568 steambooster.exe 4832 steambooster.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\steambooster = "\"c:\\users\\admin\\appdata\\local\\steambooster\\steambooster.exe\" --autostart" 2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\AppUserModelId\SteamBalance.SteamBooster steambooster.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\AppUserModelId steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\DisplayName = "SteamBooster" steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\IconUri = "C:\\Users\\Admin\\AppData\\Local\\steambooster\\app-icon.ico" steambooster.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\ShowInSettings = "1" steambooster.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe 4832 steambooster.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4832 3428 2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8e4011176f5c62bd227ae8972fd6013d_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe" --parent-pid=3428 --bootstrap-handoff2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4832
-
-
\??\c:\users\admin\appdata\local\steambooster\steambooster.exe"c:\users\admin\appdata\local\steambooster\steambooster.exe" --autostart1⤵
- Executes dropped EXE
PID:3568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-07-15.log
- Size 1KB
- SHA256 a8a482309e4846b76b5f658ac3fb9fb09b26fc1fad869f3f3f538da17b7f528b
- MD5 d039ab74b38fccbd7aea920f8caa335f
- SHA1 3ce52e58c81a23ac3bdcd6bae4e281b704fe0eda
- SHA512 b83f3c620eb5ade280ce37823df82209b925c4dfdcf91ff94d179300272048312b1835c6a82abfc70fa92e7d873ce496f9edb61dcccf74302372134668fa3538
- TLSH T19721EE410C9E78B60F038A52D847A705A8A6FA33EF65E0787BE95C088702D374BD1223
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\steambooster.exe
- Size 3.9MB
- SHA256 d6b16075e80d0e820a5555ec6b644cd695916b14c7f6eec2c874f2f7ccaedeb3
- MD5 8e4011176f5c62bd227ae8972fd6013d
- SHA1 683f22d476819ae232f2305f7942bb103a694d1d
- SHA512 50717c03698f35cefe8d452d3a86146d0e8604ccc06c327853999e3a2d1d5c461c2a7a07debd118024dbc7f4cc4a5f285fc7d35405cb9d36e85dc558659522af
- SSDEEP 98304:1Dz2a2xlwurTS4BO63iXhmoGlM7I1TnRZNpw3+Sq:Bz2a+SooXhmoGlM7I1TnHNS2
- TLSH T17D169E27A7E801E9C0B7C1B8CA578723E772B4191375A7DF1AE08A561F236E15E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 d909e81a5c2f8b749cb4eb43c1a5d8ef3c3273b401af61b5b3d78ab4a79bed32
- MD5 e77a32a2afb78f703851608cb6d10e6d
- SHA1 83c22c36f955e5e57de03d9bbe93243dc6d2b4e6
- SHA512 a954f45c1e2fa3e77055d2e5bc944c241f140adf2766b6f2d2e7bd35016934293cefec78aef0699617db7bb8db30f767cc87cb4439197faaffeed6e16c588249
- TLSH T1384168018AFD6A50D37E8CB969B752658530B871BE4FDB1C034982CC0D22A20FE66F0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\Удалить SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 87c4d310ea509ff9a76ee6d9f704079a91b57b8aabc86cf86b1a7bbe89a24528
- MD5 cbc976e9b74cc3f470cab427be175966
- SHA1 8d0feb0466b7df4db4725fd8aeae9f5764908f2b
- SHA512 bf2dec707819aeffb05aecce3271dbb82e3bba7c38799b9a533b90a8a12308ce8b7dc9009cde87c639331ca5e894e4fd044a8d1ee8e00a9cea1c8b7a6d15c6b0
- TLSH T1D54157019AED1A50D37E8DB969B651A58571BC71AE4FDB2C034882CC1C22A24FE66F1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\SteamBooster.lnk
- Size 2KB
- SHA256 30e0331a312017f0fc39a0a070ec4c1fb550ab1fc20195f6ec04d4dded8623cb
- MD5 d0c8ec495e27eaf6eef9c16d9918c1ae
- SHA1 c3d7ba37523d50cf7627e5f9bb32705a654c969b
- SHA512 7d87cdbee7866478111e00bdf96976cd79f97eb9a7210b35e6ad6a223124b2cd6260fb0eca8b987c71e4ce8c24295c6bb1dcd35bb1fa37bffdf97e718ce1fbe7
- TLSH T13C4168019AFD5A50D37F8CB969F752658530B8716E4FDA2C035882CC1D22A20FE66F0F
- MD5 SHA1 SHA512 TLSH