Overview

overview

7

Static

static

3

AR Launcher.exe

windows10-ltsc_2021-x64

7

$PLUGINSDI...ls.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

LICENSES.c...m.html

windows10-ltsc_2021-x64

3

WuWa Arabi...er.exe

windows10-ltsc_2021-x64

7

d3dcompiler_47.dll

windows10-ltsc_2021-x64

1

ffmpeg.dll

windows10-ltsc_2021-x64

1

libEGL.dll

windows10-ltsc_2021-x64

1

libGLESv2.dll

windows10-ltsc_2021-x64

1

resources/app.js

windows10-ltsc_2021-x64

3

resources/elevate.exe

windows10-ltsc_2021-x64

3

vk_swiftshader.dll

windows10-ltsc_2021-x64

1

vulkan-1.dll

windows10-ltsc_2021-x64

1

$PLUGINSDI...7z.dll

windows10-ltsc_2021-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    471s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    20/07/2026, 19:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WuWa Arabic Launcher.exe
  • Size 172.6MB
  • Sample260720-x14cdacy8m
  • SHA256 beddad12525544280d5157db7bb4bf77d44135a93274f266f65e4e883ba9f5c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2 1 TTPs 25 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,5233181136218251712,10791132654668500461,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
      2⤵
        PID:832
      • C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --standard-schemes=launcher-media --secure-schemes=launcher-media --bypasscsp-schemes=launcher-media --fetch-schemes=launcher-media --streaming-schemes=launcher-media --field-trial-handle=2096,i,5233181136218251712,10791132654668500461,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
        2⤵
          PID:2348
        • C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --standard-schemes=launcher-media --secure-schemes=launcher-media --bypasscsp-schemes=launcher-media --fetch-schemes=launcher-media --streaming-schemes=launcher-media --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2484,i,5233181136218251712,10791132654668500461,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:2644
        • C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\WuWa Arabic Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3212,i,5233181136218251712,10791132654668500461,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:6108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\Outlook Files\Client\Content\Paks\~mods\arabicEtrdream.exe'"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\Outlook Files\Client\Content\Paks\~mods\arabicEtrdream_dx11.exe'"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1508
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NonInteractive -NoProfile -Command "Unblock-File -Path 'C:\Users\Admin\Documents\Outlook Files\Client\Content\Paks\~mods\Etrdream_AR_99_P.pak'"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4276

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 b893c562f31246a825fd30e0e24bafc24325b2a82e2902e4452f07b97c8528b3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 e8d665b146b86accc2a5de3a56aa73eb4e5d022b55d625b494097bf0d025ec74
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_mwamipnb.n4w.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwamipnb.n4w.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            590aee7bdd69b59b.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            • Size 6KB
            • SHA256 8e82973b5f2db44f3da40221e0d4af476f1b3a885e83d97c72911835b8eced62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            590aee7bdd69b59b.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            • Size 6KB
            • SHA256 b1cebfb49dc3e1a8d20f500edea5bc4ab388faa50f7ee4b40c822947abbf341d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            590aee7bdd69b59b.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            • Size 6KB
            • SHA256 55f3e7afde6bb0d9d5b072b44ed5cd47bfe38638a7bc387e46340162a7bc2fc9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher\Network\Network Persistent State
            • Size 855B
            • SHA256 35e306d983e4b75ebd87bc2b68df08f7dc6819b09b112e622764ba19c61495d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe594099.TMP
            • Path C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher\Network\Network Persistent State~RFe594099.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.json
            • Path C:\Users\Admin\AppData\Roaming\WuWa Arabic Launcher\settings.json
            • Size 145B
            • SHA256 88fde99d31a3d0abf0c9e63c93999da902e4e840ed0063fcfc36d1db183ca90a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2644-184-0x0000027434480000-0x0000027434530000-memory.dmp
            Download

            memory/2644-69-0x0000027434480000-0x0000027434530000-memory.dmp
            Download

            memory/2644-44-0x00007FFA66410000-0x00007FFA66411000-memory.dmp
            Download

            memory/2644-45-0x00007FFA67430000-0x00007FFA67431000-memory.dmp
            Download

            memory/5224-142-0x000002D3FC590000-0x000002D3FC5B2000-memory.dmp
            Download

            memory/6108-94-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-100-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-102-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-103-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-104-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-105-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-101-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-99-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-93-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download

            memory/6108-95-0x000002C3A5A00000-0x000002C3A5A01000-memory.dmp
            Download