df7740b375b28ea344673f0e35a55e058388acfbfe7daa83ab51b6d77f08b067

Analysis

user interaction
yes
max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamSetup_patched.exe
Size 5.9MB
Sample260930-lrbefsxcqe
SHA256 df7740b375b28ea344673f0e35a55e058388acfbfe7daa83ab51b6d77f08b067
MD5 f4a4d972692e0d357f07093a016d97e9
SHA1 c8d8422a1039a2f5226d435883e0e32f3a9cad1c
SHA512 9e0811534ac31d2ec41af2ab59b9fb491aa79aa5152d04198ed70cd1803dae8b478fcf41ff01d5ac2fccdf1a0a4ad1900aede3a7fcb249578e9334f5c0a5e538
SSDEEP 98304:7cMXSCvVFyS+2Z5uj/TWQHRx9vxxjp1E+RBj1:3r5uj/KQxz/4+
TLSH
T19B567D52E26640ECC16BC0788756A637E7B178491330AAFF16A5D7312F23EE05B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1664	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1664	cmd.exe
2648	PING.EXE
1684	PING.EXE

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Steam\\Steam.exe\" \"%1\""	SteamSetup_patched.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal	SteamSetup_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal\ = "URL:Steam Protocol"	SteamSetup_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal\URL Protocol	SteamSetup_patched.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal\shell\open\command	SteamSetup_patched.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal\shell	SteamSetup_patched.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\steaminternal\shell\open	SteamSetup_patched.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2648	PING.EXE
1684	PING.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 988	1188	SteamSetup_patched.exe	87
PID 1188 wrote to memory of 1664	1188	SteamSetup_patched.exe	88
PID 1664 wrote to memory of 2648	1664	cmd.exe	91
PID 1664 wrote to memory of 1684	1664	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\SteamSetup_patched.exe
"C:\Users\Admin\AppData\Local\Temp\SteamSetup_patched.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\SteamSetup_patched.exe
  "C:\Users\Admin\AppData\Local\Temp\SteamSetup_patched.exe" --viewer
  2⤵
  PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping -n 4 127.0.0.1 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\SteamSetup_patched.exe" & ping -n 4 127.0.0.1 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\SteamSetup_patched.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2648
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-2-0x00007FF7020A0000-0x00007FF702692000-memory.dmp

Download

memory/1188-1-0x00007FF7020A0000-0x00007FF702692000-memory.dmp