Overview

overview

7

Static

static

3

steamtokenloginer.exe

windows10-2004-x64

7

steamtokenloginer.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 16:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    steamtokenloginer.exe
  • Size 8.6MB
  • Sample260810-vf9mjsdl9v
  • SHA256 66c9f06c2a8a07369a5e6755bee9e0e36cc3b54bfa7d2d6a2e11d070ea2c9323
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 17 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\steamtokenloginer.exe
    "C:\Users\Admin\AppData\Local\Temp\steamtokenloginer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Local\Temp\steamtokenloginer.exe
      "C:\Users\Admin\AppData\Local\Temp\steamtokenloginer.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:6048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c title WEBRAT STEAM TOKEN LOGINER
        3⤵
        • Executes a command shell one-liner
        PID:1216
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4124

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\VCRUNTIME140.dll
          • Size 96KB
          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\VCRUNTIME140_1.dll
          • Size 37KB
          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_bz2.pyd
          • Size 81KB
          • SHA256 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_cffi_backend.cp310-win_amd64.pyd
          • Size 177KB
          • SHA256 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_decimal.pyd
          • Size 242KB
          • SHA256 2bab2833c24eb4e07fe082d291013eed000a5cfc22df49311c729e7a57fe632e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_hashlib.pyd
          • Size 60KB
          • SHA256 23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_lzma.pyd
          • Size 154KB
          • SHA256 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_socket.pyd
          • Size 75KB
          • SHA256 71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\_ssl.pyd
          • Size 155KB
          • SHA256 4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\base_library.zip
          • Size 859KB
          • SHA256 80d5b24c5ddd47b420685e872ebf3d84d3c37277a2a4b39962f9b292fe9e580f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _rust.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\cryptography\hazmat\bindings\_rust.pyd
          • Size 6.4MB
          • SHA256 c3964fc08e4ca8bc193f131def6cc4b4724b18073aa0e12fed8b87c2e627dc83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\libssl-1_1.dll
          • Size 686KB
          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\python3.dll
          • Size 63KB
          • SHA256 abb50921ef463263acd7e9be19862089045074ea332421d82e765c5f2163e78a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\python310.dll
          • Size 4.3MB
          • SHA256 c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\pywin32_system32\pywintypes310.dll
          • Size 131KB
          • SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\select.pyd
          • Size 28KB
          • SHA256 8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\unicodedata.pyd
          • Size 1.1MB
          • SHA256 a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27322\win32\win32crypt.pyd
          • Size 121KB
          • SHA256 4805c4903e098f0ae3c3cbebd02b44df4d73ab19013784f49a223f501da3c853
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download