| File name: | st-setup-1.8.16.exe |
| Full analysis: | https://app.any.run/tasks/3bd0a0f6-5851-4c93-830e-3c4328336f1f |
| Verdict: | Malicious activity |
| Analysis date: | May 26, 2025, 06:43:25 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 9 sections |
| MD5: | 9C42F5CCAE30AFC9C70C924D543924F8 |
| SHA1: | 4E3C555CFEE82D23ACFDDA4754C0870F455156E8 |
| SHA256: | 80B6573208F2179C97CE64FF731269E349A07A3969C1198BF5A9092C5A01555C |
| SSDEEP: | 98304:J+dm8gYux7Ede4oqZSYVgnSoPV7dquc8GV+x7YjvyeSdRYTUhQ5WwwFPc7xqSG6i:PvI2akT6ZJJW6dEQK |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process creates files with name similar to system file names
- st-setup-1.8.16.exe (PID: 1184)
Executable content was dropped or overwritten
- st-setup-1.8.16.exe (PID: 1184)
Malware-specific behavior (creating "System.dll" in Temp)
- st-setup-1.8.16.exe (PID: 1184)
Process drops legitimate windows executable
- st-setup-1.8.16.exe (PID: 1184)
The process drops C-runtime libraries
- st-setup-1.8.16.exe (PID: 1184)
Uses ICACLS.EXE to modify access control lists
- st-setup-1.8.16.exe (PID: 1184)
There is functionality for taking screenshot (YARA)
- st-setup-1.8.16.exe (PID: 1184)
Creates a software uninstall entry
- st-setup-1.8.16.exe (PID: 1184)
Explorer used for Indirect Command Execution
- explorer.exe (PID: 5968)
Executing commands from a ".bat" file
- explorer.exe (PID: 4892)
Starts CMD.EXE for commands execution
- explorer.exe (PID: 4892)
INFO
Checks supported languages
- st-setup-1.8.16.exe (PID: 1184)
- SteamTools.exe (PID: 1676)
Reads the computer name
- st-setup-1.8.16.exe (PID: 1184)
- SteamTools.exe (PID: 1676)
Create files in a temporary directory
- st-setup-1.8.16.exe (PID: 1184)
Creates files in the program directory
- st-setup-1.8.16.exe (PID: 1184)
The sample compiled with english language support
- st-setup-1.8.16.exe (PID: 1184)
Creates files or folders in the user directory
- st-setup-1.8.16.exe (PID: 1184)
Reads security settings of Internet Explorer
- explorer.exe (PID: 4892)
Application launched itself
- firefox.exe (PID: 1628)
- firefox.exe (PID: 5048)
Checks proxy server information
- SteamTools.exe (PID: 1676)
Manual execution by a user
- firefox.exe (PID: 1628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:02:08 08:30:59+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Large address aware, No debug |
| PEType: | PE32+ |
| LinkerVersion: | 2.38 |
| CodeSize: | 36352 |
| InitializedDataSize: | 51200 |
| UninitializedDataSize: | 246784 |
| EntryPoint: | 0x4560 |
| OSVersion: | 5.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
154
Monitored processes
24
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T | C:\Windows\System32\icacls.exe | — | st-setup-1.8.16.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 720 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\SteamTools_launcher.bat" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 728 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | icacls.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 968 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2148 -prefMapHandle 2144 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aaf5ae4-df1c-49a2-b25f-09761d46ea55} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2d603d7ff10 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 1184 | "C:\Users\admin\AppData\Local\Temp\st-setup-1.8.16.exe" | C:\Users\admin\AppData\Local\Temp\st-setup-1.8.16.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1240 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1812 -parentBuildID 20240213221259 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c852ab19-26e9-4c0b-bf17-1699fa58c4cd} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2d610beae10 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 1628 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 1676 | "C:\Program Files\SteamTools\SteamTools.exe" | C:\Program Files\SteamTools\SteamTools.exe | cmd.exe | ||||||||||||
User: admin Company: steamtools.net Integrity Level: MEDIUM Description: Steamtools Version: 1.8.1.5 Modules
| |||||||||||||||
| 2564 | "C:\Users\admin\AppData\Local\Temp\st-setup-1.8.16.exe" | C:\Users\admin\AppData\Local\Temp\st-setup-1.8.16.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 4212 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2804 -childID 1 -isForBrowser -prefsHandle 2304 -prefMapHandle 2148 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb9a6691-c133-4a06-9a39-d9270bddb451} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2d615a9bf50 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
Total events
14 246
Read events
14 234
Write events
12
Delete events
0
Modification events
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | DisplayName |
Value: SteamTools | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\SteamTools\Uninstall.exe" | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Program Files\SteamTools\Uninstall.exe" /S | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\SteamTools | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\SteamTools\SteamTools.exe,0 | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools |
| Operation: | write | Name: | NoRepair |
Value: 1 | |||
| (PID) Process: | (1184) st-setup-1.8.16.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\SteamTools |
| Operation: | write | Name: | Language |
Value: 1033 | |||
| (PID) Process: | (1676) SteamTools.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Valve\Steamtools |
| Operation: | write | Name: | fScreenIndex |
Value: 0 | |||
| (PID) Process: | (1676) SteamTools.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Valve\Steamtools |
| Operation: | write | Name: | fPosition |
Value: @Point(610 100) | |||
Executable files
17
Suspicious files
145
Text files
17
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1184 | st-setup-1.8.16.exe | C:\Users\admin\AppData\Local\Temp\nswBA2C.tmp\nsDialogs.dll | executable | |
MD5:9CBB2C67258DF6CFC08E060BD8AB8309 | SHA256:4AEC3A5A78295861C8AD96B70B0520C541EA4DF60651615802AD066780CE2296 | |||
| 1184 | st-setup-1.8.16.exe | C:\Users\admin\AppData\Local\Temp\nswBA2C.tmp\modern-wizard.bmp | image | |
MD5:3614A4BE6B610F1DAF6C801574F161FE | SHA256:16E0EDC9F47E6E95A9BCAD15ADBDC46BE774FBCD045DD526FC16FC38FDC8D49B | |||
| 1184 | st-setup-1.8.16.exe | C:\Program Files\SteamTools\SteamTools.exe | executable | |
MD5:E45BFB5EDCC03451A85BC505298FBC16 | SHA256:7AFCB8D488F34E284DEEF1559DBC0D46D1BD68E226928E5B583169A1FD275842 | |||
| 1184 | st-setup-1.8.16.exe | C:\Users\admin\AppData\Local\Temp\nswBA2C.tmp\System.dll | executable | |
MD5:E74573CE106DD95B148BB8B1EF8E3418 | SHA256:D12BC87BF84C51C13F0877949BCD719C5B90D9DF8658A2F8036DDC262CB0D87B | |||
| 1184 | st-setup-1.8.16.exe | C:\Users\admin\AppData\Local\Temp\nswBA2B.tmp | — | |
MD5:— | SHA256:— | |||
| 1184 | st-setup-1.8.16.exe | C:\Program Files\SteamTools\Qt5Network.dll | executable | |
MD5:3569693D5BAE82854DE1D88F86C33184 | SHA256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1 | |||
| 1184 | st-setup-1.8.16.exe | C:\Program Files\SteamTools\Qt5Core.dll | executable | |
MD5:817520432A42EFA345B2D97F5C24510E | SHA256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A | |||
| 5048 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 1184 | st-setup-1.8.16.exe | C:\Program Files\SteamTools\Qt5Gui.dll | executable | |
MD5:47307A1E2E9987AB422F09771D590FF1 | SHA256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E | |||
| 1184 | st-setup-1.8.16.exe | C:\Program Files\SteamTools\Qt5Svg.dll | executable | |
MD5:03761F923E52A7269A6E3A7452F6BE93 | SHA256:7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
75
DNS requests
100
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1676 | SteamTools.exe | GET | 302 | 116.153.3.100:80 | http://new-service.biliapi.net/picture/chatres/update/version2.txt | unknown | — | — | unknown |
1676 | SteamTools.exe | GET | 200 | 8.133.135.83:80 | http://stools.oss-cn-shanghai.aliyuncs.com/version2.txt | unknown | — | — | unknown |
1072 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1072 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5048 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
5048 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
5048 | firefox.exe | POST | 200 | 184.24.77.45:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.5:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1676 | SteamTools.exe | 116.153.3.100:80 | new-service.biliapi.net | CHINA UNICOM China169 Backbone | CN | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
steamtools.info |
| unknown |
new-service.biliapi.net |
| unknown |
stools.oss-cn-shanghai.aliyuncs.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1676 | SteamTools.exe | Misc activity | INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0) |
2196 | svchost.exe | Misc activity | ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com) |
1676 | SteamTools.exe | Misc activity | INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0) |