Overview

overview

7

Static

static

3

st-setup-1.8.30.exe

windows10-2004-x64

7

st-setup-1.8.30.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...ec.dll

windows10-2004-x64

1

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-ltsc_2024-x64

1

Qt5Core.dll

windows10-2004-x64

1

Qt5Core.dll

windows11-ltsc_2024-x64

1

Qt5Gui.dll

windows10-2004-x64

1

Qt5Gui.dll

windows11-ltsc_2024-x64

1

Qt5Network.dll

windows10-2004-x64

1

Qt5Network.dll

windows11-ltsc_2024-x64

1

Qt5Svg.dll

windows10-2004-x64

1

Qt5Svg.dll

windows11-ltsc_2024-x64

1

Qt5Widgets.dll

windows10-2004-x64

1

Qt5Widgets.dll

windows11-ltsc_2024-x64

1

SteamTools.exe

windows10-2004-x64

1

SteamTools.exe

windows11-ltsc_2024-x64

1

imageformats/qico.dll

windows10-2004-x64

1

imageformats/qico.dll

windows11-ltsc_2024-x64

1

msvcp140.dll

windows10-2004-x64

1

msvcp140.dll

windows11-ltsc_2024-x64

1

msvcp140_1.dll

windows10-2004-x64

1

msvcp140_1.dll

windows11-ltsc_2024-x64

1

platforms/...ws.dll

windows10-2004-x64

1

platforms/...ws.dll

windows11-ltsc_2024-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 17:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    st-setup-1.8.30.exe
  • Size 10.6MB
  • Sample260718-vjvb2abw3w
  • SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 15 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe
    "C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:5596
    • C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
      2⤵
      • Modifies file permissions
      PID:4136
    • C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
      2⤵
      • Modifies file permissions
      PID:1352
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
      2⤵
        PID:1060
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Program Files\SteamTools\SteamTools.exe
        "C:\Program Files\SteamTools\SteamTools.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2832

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Core.dll
          • Path C:\Program Files\SteamTools\Core.dll
          • Size 657KB
          • SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Program Files\SteamTools\Qt5Core.dll
          • Size 5.7MB
          • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Gui.dll
          • Path C:\Program Files\SteamTools\Qt5Gui.dll
          • Size 6.7MB
          • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Network.dll
          • Path C:\Program Files\SteamTools\Qt5Network.dll
          • Size 1.3MB
          • SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Svg.dll
          • Path C:\Program Files\SteamTools\Qt5Svg.dll
          • Size 322KB
          • SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Widgets.dll
          • Path C:\Program Files\SteamTools\Qt5Widgets.dll
          • Size 5.2MB
          • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SteamTools.exe
          • Path C:\Program Files\SteamTools\SteamTools.exe
          • Size 1.7MB
          • SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qico.dll
          • Path C:\Program Files\SteamTools\imageformats\qico.dll
          • Size 37KB
          • SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Program Files\SteamTools\msvcp140.dll
          • Size 612KB
          • SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_1.dll
          • Path C:\Program Files\SteamTools\msvcp140_1.dll
          • Size 30KB
          • SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qwindows.dll
          • Path C:\Program Files\SteamTools\platforms\qwindows.dll
          • Size 1.4MB
          • SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Program Files\SteamTools\vcruntime140.dll
          • Size 83KB
          • SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Program Files\SteamTools\vcruntime140_1.dll
          • Size 43KB
          • SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss6F5B.tmp\System.dll
          • Size 12KB
          • SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nss6F5B.tmp\modern-wizard.bmp
          • Size 150KB
          • SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss6F5B.tmp\nsDialogs.dll
          • Size 10KB
          • SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss6F5B.tmp\nsExec.dll
          • Size 6KB
          • SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2832-80-0x00007FFA47FD0000-0x00007FFA48511000-memory.dmp
          Download

          memory/5596-17-0x00007FFA623A5000-0x00007FFA623A6000-memory.dmp
          Download

          memory/5596-18-0x00007FFA623A0000-0x00007FFA623A7000-memory.dmp
          Download