Overview
overview
5Static
static
3Breakers.exe
windows10-2004-x64
5Breakers.exe
windows11-ltsc_2024-x64
5addon/sksteam.dll
windows10-2004-x64
3addon/sksteam.dll
windows11-ltsc_2024-x64
3addon/steam_api.dll
windows10-2004-x64
3addon/steam_api.dll
windows11-ltsc_2024-x64
3sakanagl.dll
windows10-2004-x64
5sakanagl.dll
windows11-ltsc_2024-x64
5sxr/0-0113.js
windows10-2004-x64
3sxr/0-0113.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
200s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
Breakers.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Breakers.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
addon/sksteam.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
addon/sksteam.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
addon/steam_api.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
addon/steam_api.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
sakanagl.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
sakanagl.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
sxr/0-0113.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
sxr/0-0113.js
Resource
win11ltsc2024-20260911-en
General
- Target addon/steam_api.dll
- Size 1.4MB
- Sample261024-vbzxjscy3p
- SHA256 eaeaf26f60229ae4d1a9aae07d03ab4e93ea599dd883eb810d6adebcf0e52e14
- MD5 864735f10140a1dae1fb2495eafff3ae
- SHA1 65a4a28432d1827ca0af8cf3513ee60ddaadbe4c
- SHA512 6efc09df0a24ce40196497b1fde96fa18488b5b9382bef36382929e75e57d2086193668b22c492453d3045ffe61a6fa9216a777276973be4e076fc187f2bc7ea
- SSDEEP 24576:nMqRuY44tx6HXPYhPM5vtkelg+5tvtxTrl6mEfceT2lRLnx3N4FbqV9rssnwC7ot:nMlYKNtvgQttxTrl6y3V+bqPFnwCg39t
- TLSH T183657C363745C2F1F1CF42B079389E6F243CA656877808EBF3841B6A99225E11B3765B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1788 wrote to memory of 5816 1788 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\addon\steam_api.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\addon\steam_api.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5816
-