65d6c72d86b04045cd25b3e7f5618ba57f1f7b9ab582167dc3d8d64f27c7157b

Submit
Reports

Overview

overview

Static

static

zar-app-se...12.exe

windows7-x64

zar-app-se...12.exe

windows10-2004-x64

$PLUGINSDI...er.dll

windows7-x64

$PLUGINSDI...er.dll

windows10-2004-x64

$PLUGINSDI...ls.dll

windows7-x64

$PLUGINSDI...ls.dll

windows10-2004-x64

$PLUGINSDI...em.dll

windows7-x64

$PLUGINSDI...em.dll

windows10-2004-x64

$PLUGINSDI...ll.dll

windows7-x64

$PLUGINSDI...ll.dll

windows10-2004-x64

owutility.dll

windows7-x64

owutility.dll

windows10-2004-x64

resources/...cli.js

ubuntu-18.04-amd64

resources/...cli.js

debian-9-armhf

resources/...cli.js

debian-9-mips

resources/...cli.js

debian-9-mipsel

resources/...m.html

windows7-x64

resources/...m.html

windows10-2004-x64

resources/...47.dll

windows10-2004-x64

resources/...on.exe

windows7-x64

resources/...on.exe

windows10-2004-x64

resources/...eg.dll

windows7-x64

resources/...eg.dll

windows10-2004-x64

resources/...GL.dll

windows7-x64

resources/...GL.dll

windows10-2004-x64

resources/...v2.dll

windows7-x64

resources/...v2.dll

windows10-2004-x64

resources/...app.js

windows7-x64

resources/...app.js

windows10-2004-x64

resources/...er.dll

windows7-x64

resources/...er.dll

windows10-2004-x64

resources/...-1.dll

windows7-x64

Analysis

max time kernel
37s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 12:22

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

zar-app-setup-1.25.12.exe

Resource

win7-20231129-en

windows7-x64

6 signatures

60 seconds

Behavioral task

behavioral2

Sample

zar-app-setup-1.25.12.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

7 signatures

60 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/SpiderBanner.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/SpiderBanner.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

60 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

60 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

60 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/WinShell.dll

Resource

win7-20240220-en

windows7-x64

2 signatures

60 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/WinShell.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral11

Sample

owutility.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral12

Sample

owutility.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral13

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

ubuntu1804-amd64-20240226-en

ubuntu-18.04-amd64

2 signatures

60 seconds

Behavioral task

behavioral14

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

debian9-armhf-20240226-en

antivm

debian-9-armhf

4 signatures

60 seconds

Behavioral task

behavioral15

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

debian9-mipsbe-20240226-en

debian-9-mips

0 signatures

60 seconds

Behavioral task

behavioral16

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

debian9-mipsel-20240226-en

debian-9-mipsel

0 signatures

60 seconds

Behavioral task

behavioral17

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/LICENSES.chromium.html

Resource

win7-20240221-en

windows7-x64

4 signatures

60 seconds

Behavioral task

behavioral18

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/LICENSES.chromium.html

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral19

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/d3dcompiler_47.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral20

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/electron.exe

Resource

win7-20231129-en

windows7-x64

4 signatures

60 seconds

Behavioral task

behavioral21

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/electron.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral22

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/ffmpeg.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

60 seconds

Behavioral task

behavioral23

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/ffmpeg.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral24

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libEGL.dll

Resource

win7-20231129-en

windows7-x64

0 signatures

60 seconds

Behavioral task

behavioral25

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libEGL.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral26

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libGLESv2.dll

Resource

win7-20240215-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral27

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libGLESv2.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral28

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/resources/default_app.js

Resource

win7-20240221-en

windows7-x64

0 signatures

60 seconds

Behavioral task

behavioral29

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/resources/default_app.js

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral30

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vk_swiftshader.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral31

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vk_swiftshader.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral32

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vulkan-1.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Report Analysis Logs

General

Target

owutility.dll
Size

1.4MB
MD5

27e245824c1cd5f0b68e65f974651e3d
SHA1

0f8ab8787521090f54f0719c77bf27b2d1f5d537
SHA256

83615357c5b81bc2047cefa22b3fe88260467a69a190fd7cd36649411a4529f1
SHA512

c27a28db1f5b667c390e5a54204d8a78fa1fd76388f5614523054e037770045dda7f7546e230e59d9eb931fc69a91289bb41419571ee60bf8a28baa23b6f6f4a
SSDEEP

24576:s9mW+IacegtK/KzWfuBRidv/Eg//aErsVRgf3KvmZJ6NpobhmhGycID8SJKK:s9mRFIK/KzyuBRidUg/SErsXgfavmu//

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2380 wrote to memory of 1804	2380	rundll32.exe	WerFault.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	WerFault.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	WerFault.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\owutility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2380 -s 140
2⤵
PID:1804

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads