Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe
- Size 3.9MB
- Sample260802-darfcacb64
- SHA256 395ba17faefaf839917f7adfe357a5683fc3f7d90db70f72e545a1fb236bba70
- MD5 a0235153053b66547cab352fa72407e5
- SHA1 2b006ca14b3dd18ec932e27bbb5421dfa45dc2c0
- SHA512 dd5fc0f1af5dd350ffdc1ac83ff2f2fbd90a9b9efbc76706d26671f69f3f922f8da1ebd9bb55053fe8e0e0254a5b7ecfc9d30e1c8e27916b00305b0338046e70
- SSDEEP 98304:AHAUN1kTtO7Zq09J1PTuHbfudtRZzUi7bh5:YAUt751PTuHbfudtRZgi7b7
- TLSH T15C169E27B3E801EAC0B7C1B8C9578623E772B4591375A7DF16E08A561F236E16E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4224 steambooster.exe 3392 steambooster.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\steambooster = "\"c:\\users\\admin\\appdata\\local\\steambooster\\steambooster.exe\" --autostart" 2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\AppUserModelId\SteamBalance.SteamBooster steambooster.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\AppUserModelId steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\DisplayName = "SteamBooster" steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\IconUri = "C:\\Users\\Admin\\AppData\\Local\\steambooster\\app-icon.ico" steambooster.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\ShowInSettings = "1" steambooster.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe 3392 steambooster.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1572 wrote to memory of 3392 1572 2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0235153053b66547cab352fa72407e5_akira_gazer_glassworm_helldown_icedid_luca-stealer_njrat_remcos_stealc.exe" --parent-pid=1572 --bootstrap-handoff2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3392
-
-
\??\c:\users\admin\appdata\local\steambooster\steambooster.exe"c:\users\admin\appdata\local\steambooster\steambooster.exe" --autostart1⤵
- Executes dropped EXE
PID:4224
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-02.log
- Size 1KB
- SHA256 036e94e0bcca6c4e669e90b78884aa835c20a9d2f3d5adc878c03636fa02353e
- MD5 87de9731cc53f1fdd32edf6144ae8a69
- SHA1 9827128afaa2243482b587124e87dba46543c07e
- SHA512 05b165e998d64df5f2a01f3e69b1e0bfe1e9bcd3faff8652c2e011cdfa8c1ea57d106c8ec1d84707cbf5c725972e627380ca82d060fef393c613c9c3c5f58dc5
- TLSH T119217B268EAB78A76F0B8A0FE89F3B2D6401F531ED56A078FBE55C05001392646D1613
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\steambooster.exe
- Size 3.9MB
- SHA256 395ba17faefaf839917f7adfe357a5683fc3f7d90db70f72e545a1fb236bba70
- MD5 a0235153053b66547cab352fa72407e5
- SHA1 2b006ca14b3dd18ec932e27bbb5421dfa45dc2c0
- SHA512 dd5fc0f1af5dd350ffdc1ac83ff2f2fbd90a9b9efbc76706d26671f69f3f922f8da1ebd9bb55053fe8e0e0254a5b7ecfc9d30e1c8e27916b00305b0338046e70
- SSDEEP 98304:AHAUN1kTtO7Zq09J1PTuHbfudtRZzUi7bh5:YAUt751PTuHbfudtRZgi7b7
- TLSH T15C169E27B3E801EAC0B7C1B8C9578623E772B4591375A7DF16E08A561F236E16E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 eaecaa9e81886fd07afdb1724ec47785aadcdd8df577b245b0b2a5e3c95ae5d1
- MD5 bf842c702b9eef34c721307698b63879
- SHA1 02c7c3f129808de61111b2f846231407cbcf11dd
- SHA512 c8c25e1f8db3233f087e6d9beede002c2860c0c051d24b44999410429bf4b96a3263ce00ea27884f11ae9ee7dbce002e81f14653d5267555cb0091ab116d74f3
- TLSH T1A641650186E82A11C77B9CB968B74255C874B871BF0BCA1D0348A6DC0926E20FE26F1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\Удалить SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 5f416131dd6b74b8b2f29125f22f620d82fedf8978ee044404dc6051e2dea097
- MD5 9f2fe4bcfe01a9b69ac96833ac9442dd
- SHA1 123a7e33adfeeb2381fdf18ba6be599f09123134
- SHA512 317d083f95fbfe10ce9648bc357abbef745c0d6dda7711d49f320364ce43d13dc76df72cfdffc3c03279f2641e967dce60957041c14b4db769cb5f3807bf5df5
- TLSH T1A34177019AE92A11C7779DB969B24291C874BC71BF0F8A1C030496DC0C21E24FE22F1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\SteamBooster.lnk
- Size 2KB
- SHA256 75ed65ac0a513aed14db8e095c08fa3178d331937c8db2446f19a2b1618faed5
- MD5 b127bf509f5ec3783cdb0b98908da346
- SHA1 9298cfb1b1a6b97f9cc3b8662b79094aef46fdb8
- SHA512 d586640b8eee391c5b760270a9774045322d8eb5dc17fbc90d875e4e45628ff9b8e0d33b1f0be66044abf0f21bcff8b49d174049f95dfe85f00bf1853ed6b972
- TLSH T1D64186019AF81611C77B9CB969B35291C974B871BF0BCA1D0348A68C0D32E20FE26B1F
- MD5 SHA1 SHA512 TLSH