65d6c72d86b04045cd25b3e7f5618ba57f1f7b9ab582167dc3d8d64f27c7157b

Submit
Reports

Overview

overview

Static

static

zar-app-se...12.exe

windows7-x64

zar-app-se...12.exe

windows10-2004-x64

$PLUGINSDI...er.dll

windows7-x64

$PLUGINSDI...er.dll

windows10-2004-x64

$PLUGINSDI...ls.dll

windows7-x64

$PLUGINSDI...ls.dll

windows10-2004-x64

$PLUGINSDI...em.dll

windows7-x64

$PLUGINSDI...em.dll

windows10-2004-x64

$PLUGINSDI...ll.dll

windows7-x64

$PLUGINSDI...ll.dll

windows10-2004-x64

owutility.dll

windows7-x64

owutility.dll

windows10-2004-x64

resources/...cli.js

ubuntu-18.04-amd64

resources/...cli.js

debian-9-armhf

resources/...cli.js

debian-9-mips

resources/...cli.js

debian-9-mipsel

resources/...m.html

windows7-x64

resources/...m.html

windows10-2004-x64

resources/...47.dll

windows10-2004-x64

resources/...on.exe

windows7-x64

resources/...on.exe

windows10-2004-x64

resources/...eg.dll

windows7-x64

resources/...eg.dll

windows10-2004-x64

resources/...GL.dll

windows7-x64

resources/...GL.dll

windows10-2004-x64

resources/...v2.dll

windows7-x64

resources/...v2.dll

windows10-2004-x64

resources/...app.js

windows7-x64

resources/...app.js

windows10-2004-x64

resources/...er.dll

windows7-x64

resources/...er.dll

windows10-2004-x64

resources/...-1.dll

windows7-x64

Analysis

max time kernel
37s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 12:22

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

zar-app-setup-1.25.12.exe

Resource

win7-20231129-en

windows7-x64

6 signatures

60 seconds

Behavioral task

behavioral2

Sample

zar-app-setup-1.25.12.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

7 signatures

60 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/SpiderBanner.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/SpiderBanner.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

60 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

60 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

60 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/WinShell.dll

Resource

win7-20240220-en

windows7-x64

2 signatures

60 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/WinShell.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral11

Sample

owutility.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral12

Sample

owutility.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral13

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

ubuntu1804-amd64-20240226-en

ubuntu-18.04-amd64

2 signatures

60 seconds

Behavioral task

behavioral14

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

debian9-armhf-20240226-en

antivm

debian-9-armhf

4 signatures

60 seconds

Behavioral task

behavioral15

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

debian9-mipsbe-20240226-en

debian-9-mips

0 signatures

60 seconds

Behavioral task

behavioral16

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/cli.js

Resource

debian9-mipsel-20240226-en

debian-9-mipsel

0 signatures

60 seconds

Behavioral task

behavioral17

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/LICENSES.chromium.html

Resource

win7-20240221-en

windows7-x64

4 signatures

60 seconds

Behavioral task

behavioral18

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/LICENSES.chromium.html

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral19

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/d3dcompiler_47.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral20

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/electron.exe

Resource

win7-20231129-en

windows7-x64

4 signatures

60 seconds

Behavioral task

behavioral21

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/electron.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral22

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/ffmpeg.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

60 seconds

Behavioral task

behavioral23

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/ffmpeg.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral24

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libEGL.dll

Resource

win7-20231129-en

windows7-x64

0 signatures

60 seconds

Behavioral task

behavioral25

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libEGL.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral26

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libGLESv2.dll

Resource

win7-20240215-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral27

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/libGLESv2.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral28

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/resources/default_app.js

Resource

win7-20240221-en

windows7-x64

0 signatures

60 seconds

Behavioral task

behavioral29

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/resources/default_app.js

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral30

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vk_swiftshader.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Behavioral task

behavioral31

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vk_swiftshader.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral32

Sample

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vulkan-1.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

60 seconds

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/@overwolf/ow-electron/dist/vulkan-1.dll
Size

876KB
MD5

cb0f13601b8592059f9fffc5acd6fb10
SHA1

a3834e36b498148a9eb3b282250ca4760647e70e
SHA256

fb0600d5930d7c9ee9794c0929428837eb903a5c554f7606642a977e39e4ce2d
SHA512

f08d9fa4256f0f0b31f710def89af8c22e76a6b91d40d49ac376cb7abc2a851c0cb713fc05c210a2758c573864010d745e7b06938c8ee9784722aa0838113109
SSDEEP

12288:PPcsZ/i18O9zheQQZ7bjnfjaimmVBmJUAI0/bf1IohbX6G62KB0:PPcL19F0QCn5VBKQmSYfi0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2324 wrote to memory of 308	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 308	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 308	2324	rundll32.exe	WerFault.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@overwolf\ow-electron\dist\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2324 -s 88
2⤵
PID:308

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads