File name:

overwolf-254-0-12.exe

Full analysis: https://app.any.run/tasks/287398b1-d041-4c9e-9c53-eeabac5c1378
Verdict: Malicious activity
Analysis date: December 19, 2024, 17:40:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

A652CC46210F0C6A9BBF12AC7EA2B619

SHA1:

D46E4AFF2CB2C1CC52849DE7CD8CE693BC1E6A82

SHA256:

B981B990AFA5F35ACE0BB72F470494DCAAEAE2A3A6335EDC5920A492B8512F8C

SSDEEP:

98304:guqtQZWJ/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhuhKrHVk2ENB0+o1QVNGRplw:H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • overwolf-254-0-12.exe (PID: 6180)
      • overwolf-254-0-12.exe (PID: 6364)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • overwolf-254-0-12.exe (PID: 6180)
      • overwolf-254-0-12.exe (PID: 6364)

    • Reads security settings of Internet Explorer

      • overwolf-254-0-12.exe (PID: 6180)
      • OWInstaller.exe (PID: 6464)

    • Executable content was dropped or overwritten

      • overwolf-254-0-12.exe (PID: 6180)
      • overwolf-254-0-12.exe (PID: 6364)

    • Application launched itself

      • overwolf-254-0-12.exe (PID: 6180)

    • Reads the date of Windows installation

      • OWInstaller.exe (PID: 6464)

    • Creates/Modifies COM task schedule object

      • dxdiag.exe (PID: 6900)

    • Reads Microsoft Outlook installation path

      • OWInstaller.exe (PID: 6464)

    • Reads Internet Explorer settings

      • OWInstaller.exe (PID: 6464)

    • Checks Windows Trust Settings

      • OWInstaller.exe (PID: 6464)

  • INFO

    • The sample compiled with english language support

      • overwolf-254-0-12.exe (PID: 6180)
      • overwolf-254-0-12.exe (PID: 6364)

    • Checks supported languages

      • overwolf-254-0-12.exe (PID: 6180)
      • overwolf-254-0-12.exe (PID: 6364)
      • OWInstaller.exe (PID: 6464)

    • Reads the computer name

      • overwolf-254-0-12.exe (PID: 6180)
      • overwolf-254-0-12.exe (PID: 6364)
      • OWInstaller.exe (PID: 6464)

    • Create files in a temporary directory

      • overwolf-254-0-12.exe (PID: 6180)
      • OWInstaller.exe (PID: 6464)

    • Process checks computer location settings

      • overwolf-254-0-12.exe (PID: 6180)
      • OWInstaller.exe (PID: 6464)

    • Checks proxy server information

      • overwolf-254-0-12.exe (PID: 6364)
      • OWInstaller.exe (PID: 6464)
      • dxdiag.exe (PID: 6900)

    • Reads the machine GUID from the registry

      • OWInstaller.exe (PID: 6464)

    • Creates files or folders in the user directory

      • OWInstaller.exe (PID: 6464)

    • Reads Environment values

      • OWInstaller.exe (PID: 6464)

    • Reads product name

      • OWInstaller.exe (PID: 6464)

    • The process uses the downloaded file

      • OWInstaller.exe (PID: 6464)

    • Disables trace logs

      • OWInstaller.exe (PID: 6464)

    • Reads the software policy settings

      • OWInstaller.exe (PID: 6464)
      • dxdiag.exe (PID: 6900)

    • Reads security settings of Internet Explorer

      • dxdiag.exe (PID: 6900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:57:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 186880
UninitializedDataSize: 2048
EntryPoint: 0x352d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.250.0.1
ProductVersionNumber: 2.250.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Overwolf Ltd.
FileDescription: Overwolf
FileVersion: 2.250.0.1
LegalCopyright: Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks: -
ProductName: Overwolf
ProductVersion: 2.250.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start overwolf-254-0-12.exe overwolf-254-0-12.exe owinstaller.exe dxdiag.exe

Process information

PID
CMD
Path
Indicators
Parent process
6180"C:\Users\admin\AppData\Local\Temp\overwolf-254-0-12.exe" C:\Users\admin\AppData\Local\Temp\overwolf-254-0-12.exe
explorer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
MEDIUM
Description:
Overwolf
Version:
2.250.0.1
Modules
Images
c:\users\admin\appdata\local\temp\overwolf-254-0-12.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6364"C:\Users\admin\AppData\Local\Temp\overwolf-254-0-12.exe" /UAC:8007E /NCRC C:\Users\admin\AppData\Local\Temp\overwolf-254-0-12.exe
overwolf-254-0-12.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
HIGH
Description:
Overwolf
Version:
2.250.0.1
Modules
Images
c:\users\admin\appdata\local\temp\overwolf-254-0-12.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6464"C:\Users\admin\AppData\Local\Temp\nsi5F3B.tmp\OWinstaller.exe" Sel=0&Referer=www.filehorse.com&Browser=microsoftedge /UAC:8007E /NCRC -partnerCustomizationLevel 0 -exepath C:\Users\admin\AppData\Local\Temp\overwolf-254-0-12.exe C:\Users\admin\AppData\Local\Temp\nsi5F3B.tmp\OWInstaller.exe
overwolf-254-0-12.exe
User:
admin
Company:
Overwolf
Integrity Level:
HIGH
Description:
Overwolf Installer
Version:
2.250.0.2
Modules
Images
c:\users\admin\appdata\local\temp\nsi5f3b.tmp\owinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6900"C:\WINDOWS\System32\DxDiag.exe" /tC:\Users\admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txtC:\Windows\System32\dxdiag.exe
OWInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft DirectX Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dxdiag.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
11 351
Read events
11 192
Write events
138
Delete events
21

Modification events

(PID) Process:(6364) overwolf-254-0-12.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6364) overwolf-254-0-12.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6364) overwolf-254-0-12.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6900) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:writeName:DxDiag In SystemInfo
Value:
1
(PID) Process:(6464) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6464) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6464) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6464) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6464) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6464) OWInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
33
Suspicious files
82
Text files
120
Unknown types
3

Dropped files

PID
Process
Filename
Type
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\UserInfo.dllexecutable
MD5:9301577FF4D229347FE33259B43EF3B2
SHA256:090C4BC8DC534E97B3877BD5115EB58B3E181495F29F231479F540BAB5C01EDC
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\nsProcess.dllexecutable
MD5:F0438A894F3A7E01A4AAE8D1B5DD0289
SHA256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\OWInstaller.exe.configxml
MD5:82D22E4E19E27E306317513B9BFA70FF
SHA256:272E4C5364193E73633CAA3793E07509A349B79314EA01808B24FDB12C51B827
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\System.dllexecutable
MD5:7399323923E3946FE9140132AC388132
SHA256:5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\OverWolf.Client.CommonUtils.dllexecutable
MD5:6A45B1F51B619BA08761FC91567BF0A7
SHA256:4AD3ECD0591F8DAD217D5D99E11D809CC699C28F55296845148254F6FCE69828
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\OWInstaller.exeexecutable
MD5:AE8104779326BCDCD3351CCD909EF70F
SHA256:C1B2F28D8391FD1424A4C54B77E20CFE72FB0443DC495060F313D1D550FF3C81
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\log4net.dllexecutable
MD5:F15C8A9E2876568B3910189B2D493706
SHA256:AE9C8073C3357C490F5D1C64101362918357C568F6B9380A60B09A4A4C1FF309
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\DotNetZip.dllexecutable
MD5:190E712F2E3B065BA3D5F63CB9B7725E
SHA256:6C512D9943A225D686B26FC832589E4C8BEF7C4DD0A8BDFD557D5D27FE5BBA0F
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\websocket-sharp.dllexecutable
MD5:CB39CB181DE7D36C82D2DFD178802F38
SHA256:8B7230E7CD859DDEEB5FB48346E9576E47098C1009620C2E5D585BEF4B108FBC
6180overwolf-254-0-12.exeC:\Users\admin\AppData\Local\Temp\nsv5894.tmp\SharpRaven.dllexecutable
MD5:8F6FF3176E7F0B58B033B3D3F1303DB3
SHA256:0EA20361A01F8FC8EAB21AB5613E77D36A3506793D4487438C314DAF86E90630
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
57
DNS requests
36
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6364
overwolf-254-0-12.exe
GET
200
18.244.18.56:80
http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.250.0.1%22%7d%5d
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6464
OWInstaller.exe
GET
200
142.250.185.238:80
http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=430372292&utmhn=&utmcs=UTF-8&utmsr=-&utmsc=-&utmul=-&utmje=0&utmfl=-&utmdt=&utmhid=150746009&utmr=/&utmp=/&utmac=UA-18298709-8&utmcc=__utma%3D0.1821671973.1734630070.1734630070.1734630070.2%3B%2B__utmz%3D0.1734630070.1.1.utmcsr%3D%28direct%29%7Cutmccn%3D%7Cutmcmd%3D%3B&utme=5%28Funnel2%2AInstaller%20Launched%2A2.0.50727%20SP2%2C%203.0%20SP2%2C%203.5%20SP1%2C%204%20Client%2C%204%20Full%2C%204.0%20Client%29%28%29&gaq=1&utmt=event
unknown
—
—
whitelisted
6464
OWInstaller.exe
GET
200
142.250.185.238:80
http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=573218252&utmhn=&utmcs=UTF-8&utmsr=-&utmsc=-&utmul=-&utmje=0&utmfl=-&utmdt=&utmhid=682743783&utmr=/&utmp=/&utmac=UA-80584726-1&utmcc=__utma%3D0.1821671973.1734630070.1734630070.1734630070.2%3B%2B__utmz%3D0.1734630070.1.1.utmcsr%3D%28direct%29%7Cutmccn%3D%7Cutmcmd%3D%3B&utme=5%28Funnel2%2AInstaller%20Launched%2A2.0.50727%20SP2%2C%203.0%20SP2%2C%203.5%20SP1%2C%204%20Client%2C%204%20Full%2C%204.0%20Client%29%28%29&gaq=1&utmt=event
unknown
—
—
whitelisted
6464
OWInstaller.exe
GET
200
18.65.32.231:80
http://ocsp.rootca3.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRkNawYMzz%2BjKSfYbTyFR0AXuhs6QQUq7bb1waeN6wwhgeRcMecxBmxeMACEwdzEm3iwvr9LEetiLFWbgGCBG0%3D
unknown
—
—
unknown
6464
OWInstaller.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
6464
OWInstaller.exe
GET
200
142.250.185.99:80
http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEBq45CZh5KL8ELKDxLAxb88%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.141:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
www.bing.com
  • 2.23.209.141
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.160
  • 2.23.209.181
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.135
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
analyticsnew.overwolf.com
  • 18.244.18.56
  • 18.244.18.46
  • 18.244.18.106
  • 18.244.18.51
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.2
whitelisted
www.google-analytics.com
  • 142.250.185.238
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
overwolf-254-0-12.exe