File name:

Thunderstore Mod Manager - Installer.rar

Full analysis: https://app.any.run/tasks/7eeca9fd-a918-4176-afc7-66702ffbb1be
Verdict: Malicious activity
Analysis date: February 21, 2024, 14:20:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E83DDAEA03BE18CA73FDED8DF551CD58

SHA1:

F612825C7C28C8F710B1D02E1E0E70D087A6C0AD

SHA256:

EBDDB4B77ED9AA2953E13871D5C585281739FDD0CD6308DB0097656DD049C003

SSDEEP:

98304:nVLN1tGKjvOxYT+z5Y+uvq3BrmgjzhseFt6XlbyhOgvpjyJZaNkIwYjGyxVi3Hs9:c9H99

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Drops 7-zip archiver for unpacking

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Executable content was dropped or overwritten

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Application launched itself

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3864)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Reads the Internet Settings

      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3864)

    • Checks supported languages

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3864)

    • Reads the computer name

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Create files in a temporary directory

      • Thunderstore Mod Manager - Installer.exe (PID: 3720)
      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 2064)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Reads the machine GUID from the registry

      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Creates files or folders in the user directory

      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Reads Environment values

      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)

    • Manual execution by a user

      • Thunderstore Mod Manager - Installer.exe (PID: 2064)

    • Checks proxy server information

      • Thunderstore Mod Manager - Installer.exe (PID: 2444)
      • Thunderstore Mod Manager - Installer.exe (PID: 240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe thunderstore mod manager - installer.exe thunderstore mod manager - installer.exe thunderstore mod manager - installer.exe thunderstore mod manager - installer.exe

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\Desktop\Thunderstore Mod Manager - Installer.exe" /UAC:13019C /NCRC C:\Users\admin\Desktop\Thunderstore Mod Manager - Installer.exe
Thunderstore Mod Manager - Installer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
HIGH
Description:
Overwolf
Exit code:
1223
Version:
2.240.0.4
Modules
Images
c:\users\admin\desktop\thunderstore mod manager - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2064"C:\Users\admin\Desktop\Thunderstore Mod Manager - Installer.exe" C:\Users\admin\Desktop\Thunderstore Mod Manager - Installer.exe
explorer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
MEDIUM
Description:
Overwolf
Exit code:
1223
Version:
2.240.0.4
Modules
Images
c:\users\admin\desktop\thunderstore mod manager - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2444"C:\Users\admin\AppData\Local\Temp\Rar$EXa3864.26876\Thunderstore Mod Manager - Installer.exe" /UAC:120152 /NCRC C:\Users\admin\AppData\Local\Temp\Rar$EXa3864.26876\Thunderstore Mod Manager - Installer.exe
Thunderstore Mod Manager - Installer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
HIGH
Description:
Overwolf
Exit code:
1223
Version:
2.240.0.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3864.26876\thunderstore mod manager - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3720"C:\Users\admin\AppData\Local\Temp\Rar$EXa3864.26876\Thunderstore Mod Manager - Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3864.26876\Thunderstore Mod Manager - Installer.exe
WinRAR.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
MEDIUM
Description:
Overwolf
Exit code:
1223
Version:
2.240.0.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3864.26876\thunderstore mod manager - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Thunderstore Mod Manager - Installer.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
11 501
Read events
11 420
Write events
71
Delete events
10

Modification events

(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Thunderstore Mod Manager - Installer.rar
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
66
Suspicious files
35
Text files
232
Unknown types
37

Dropped files

PID
Process
Filename
Type
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\OWInstaller.exeexecutable
MD5:DB53712E60B63596DF16787467A5B1D3
SHA256:76D94EB510BE3D6E3FF5FA381022B6ED141AABCF824036198FDCC7A73BFF5A05
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\Newtonsoft.Json.dllexecutable
MD5:98CBB64F074DC600B23A2EE1A0F46448
SHA256:7B44639CBFBC8DDAC8C7A3DE8FFA97A7460BEBB0D54E9FF2E1CCDC3A742C2B13
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\uac.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\nsProcess.dllexecutable
MD5:F0438A894F3A7E01A4AAE8D1B5DD0289
SHA256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\System.dllexecutable
MD5:7399323923E3946FE9140132AC388132
SHA256:5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3864.26876\Thunderstore Mod Manager - Installer.exeexecutable
MD5:FA33FE815EDBBD6FDB26A228968383D7
SHA256:99904817ED2B2A3C5E517CCDBD4C2A8F5C6C3C8405E638D92E3444C567693C6E
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\UserInfo.dllexecutable
MD5:9301577FF4D229347FE33259B43EF3B2
SHA256:090C4BC8DC534E97B3877BD5115EB58B3E181495F29F231479F540BAB5C01EDC
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\DotNetZip.dllexecutable
MD5:190E712F2E3B065BA3D5F63CB9B7725E
SHA256:6C512D9943A225D686B26FC832589E4C8BEF7C4DD0A8BDFD557D5D27FE5BBA0F
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:AA5EBFF82CEF6EF1A15C468E6055356F
SHA256:7F47038A76EE0D39498299DECABD203A45991A0D8D03B63EC588108DD50678AA
3720Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nsv686A.tmp\log4net.dllexecutable
MD5:F15C8A9E2876568B3910189B2D493706
SHA256:AE9C8073C3357C490F5D1C64101362918357C568F6B9380A60B09A4A4C1FF309
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
240
Thunderstore Mod Manager - Installer.exe
GET
200
18.244.18.106:80
http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.240.0.4%22%7d%5d
unknown
—
2 b
unknown
2444
Thunderstore Mod Manager - Installer.exe
GET
200
18.244.18.106:80
http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.240.0.4%22%7d%5d
unknown
—
2 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2444
Thunderstore Mod Manager - Installer.exe
18.244.18.106:80
analyticsnew.overwolf.com
—
US
unknown
240
Thunderstore Mod Manager - Installer.exe
18.244.18.106:80
analyticsnew.overwolf.com
—
US
unknown

DNS requests

Domain
IP
Reputation
analyticsnew.overwolf.com
  • 18.244.18.106
  • 18.244.18.46
  • 18.244.18.51
  • 18.244.18.56
unknown

Threats

PID
Process
Class
Message
2444
Thunderstore Mod Manager - Installer.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
240
Thunderstore Mod Manager - Installer.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Thunderstore Mod Manager - Installer.rar