Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
- Size 3.9MB
- Sample260802-darfcacb64
- SHA256 395ba17faefaf839917f7adfe357a5683fc3f7d90db70f72e545a1fb236bba70
- MD5 a0235153053b66547cab352fa72407e5
- SHA1 2b006ca14b3dd18ec932e27bbb5421dfa45dc2c0
- SHA512 dd5fc0f1af5dd350ffdc1ac83ff2f2fbd90a9b9efbc76706d26671f69f3f922f8da1ebd9bb55053fe8e0e0254a5b7ecfc9d30e1c8e27916b00305b0338046e70
- SSDEEP 98304:AHAUN1kTtO7Zq09J1PTuHbfudtRZzUi7bh5:YAUt751PTuHbfudtRZgi7b7
- TLSH T15C169E27B3E801EAC0B7C1B8C9578623E772B4591375A7DF16E08A561F236E16E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2076 steambooster.exe 4028 steambooster.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steambooster = "\"c:\\users\\admin\\appdata\\local\\steambooster\\steambooster.exe\" --autostart" 2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\SteamBalance.SteamBooster steambooster.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\DisplayName = "SteamBooster" steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\IconUri = "C:\\Users\\Admin\\AppData\\Local\\steambooster\\app-icon.ico" steambooster.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\ShowInSettings = "1" steambooster.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe 4028 steambooster.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3624 wrote to memory of 4028 3624 2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe" --parent-pid=3624 --bootstrap-handoff2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4028
-
-
\??\c:\users\admin\appdata\local\steambooster\steambooster.exe"c:\users\admin\appdata\local\steambooster\steambooster.exe" --autostart1⤵
- Executes dropped EXE
PID:2076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-02.log
- Size 1KB
- SHA256 b1871ff622cd0d8f53c00730de75467148aedd7617d74a0b50a654d5ddd6f21f
- MD5 28f2fab46c8c199947b9d214337d4b7e
- SHA1 519b3302e4f480340974fb047783a769ab94f575
- SHA512 73b0e9eba64c564926ed634358a10c839017b2376eb164091f7819c49da04718a9d36d6725054b7580fb4df976778e42e17de840c59e99c6bb9591070fe778ab
- TLSH T19B212CA24BAA74B76F0B491ED8DB3F1D58127431EC56B078EBD52C04104353646F2613
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\steambooster.exe
- Size 3.9MB
- SHA256 395ba17faefaf839917f7adfe357a5683fc3f7d90db70f72e545a1fb236bba70
- MD5 a0235153053b66547cab352fa72407e5
- SHA1 2b006ca14b3dd18ec932e27bbb5421dfa45dc2c0
- SHA512 dd5fc0f1af5dd350ffdc1ac83ff2f2fbd90a9b9efbc76706d26671f69f3f922f8da1ebd9bb55053fe8e0e0254a5b7ecfc9d30e1c8e27916b00305b0338046e70
- SSDEEP 98304:AHAUN1kTtO7Zq09J1PTuHbfudtRZzUi7bh5:YAUt751PTuHbfudtRZgi7b7
- TLSH T15C169E27B3E801EAC0B7C1B8C9578623E772B4591375A7DF16E08A561F236E16E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 278a441a255accfdae85fd12741f29f7b4b7d18071ddea8e4a4c6e973296eccd
- MD5 563f803354b214f117ce99d0857092c5
- SHA1 68f1739b4d7560b1d4213173a1781c52fa573379
- SHA512 be90d830f0c937220469cf1cbc4e06a60f78129bf5dc24476ebd40f029ea95ab56bee35ecd8e95d5045378b21b02ff866452c2964d2dce8aad88a4c6accf5ca8
- TLSH T18541882085ED2A60D77ADCB895B382658574B830BF0FDA5C034992CC0C21E29FE26F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\Удалить SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 0bedaac1b1f2b430b9638cbb28f39ff0004a914d6808f284a54a9ba42709ee2e
- MD5 1fab1c5df6cba5eb5536a899e786d29e
- SHA1 544ac2cf1a53c16bde1f4ac80fcdb22feeda47ab
- SHA512 dd0ad717523ae3b1d8c2f13f838cdd733e93c38832aef02a7cd1c9cd2b28b6f4c30ee67173226fc3bb7e69d81e6025a7b9f1fb4756e8a3aedba01291bb85e97b
- TLSH T11F41AC2155E92E60D776DCB8A5B242918574BC30BF0FDA1C134992CC0C21E29FE26F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\SteamBooster.lnk
- Size 2KB
- SHA256 f48c55865bbb09881752b4a528d856ee4342bf4cb1986563c982d88013c8b95a
- MD5 4ff77949266d46f6b7a3c02cd186aa21
- SHA1 1e03eaa01ee6526bda2ea9e279113a6680ffb836
- SHA512 d1bac72fd32d14716748c50d5cd6b7e1aba54cd0cdc3d7a0d4c0b7d4a7e5785558499897efddde2f14b86ec900935f652a552d12bc7aa8b2abb737d02080a365
- TLSH T14041BC2199ED1960D77ADCB8A5B392518574B830BF0FDA5C034996CC0C31E25FE26B1F
- MD5 SHA1 SHA512 TLSH