Overview
overview
8Static
static
3EaseUS Dat...R].zip
windows7-x64
1EaseUS Dat...R].zip
windows10-2004-x64
1EaseUS Dat...ir.zip
windows7-x64
1EaseUS Dat...ir.zip
windows10-2004-x64
11- Hosts b...er.bat
windows7-x64
81- Hosts b...er.bat
windows10-2004-x64
82- Patcher....1.exe
windows7-x64
72- Patcher....1.exe
windows10-2004-x64
72- Patcher....1.exe
windows7-x64
72- Patcher....1.exe
windows10-2004-x64
73- KeyGen ...e!.exe
windows7-x64
13- KeyGen ...e!.exe
windows10-2004-x64
1ReadMe (EDRW).txt
windows7-x64
1ReadMe (EDRW).txt
windows10-2004-x64
1EaseUS Dat...up.exe
windows7-x64
4EaseUS Dat...up.exe
windows10-2004-x64
4Resubmissions
15/06/2026, 01:28
260615-bv4kasgv4x10/06/2026, 07:32
260610-jdfe5sgv8m21/04/2026, 03:57
260421-ejapmabt6s26/02/2026, 11:07
260226-m7zbwsb16d20/10/2025, 19:02
251020-xp6ncsdk3z23/02/2024, 14:33
240223-rw7aksbb358Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
23/02/2024, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual [FileCR].zip
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual [FileCR].zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/EDRW Patch v1.1 & Activator 2.1 - yaschir.zip
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/EDRW Patch v1.1 & Activator 2.1 - yaschir.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
1- Hosts blocker/EaseUS hosts blocker.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
1- Hosts blocker/EaseUS hosts blocker.bat
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
2- Patcher/(32-Bit) EDRW Patcher v1.1.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
2- Patcher/(32-Bit) EDRW Patcher v1.1.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
2- Patcher/(64-Bit) EDRW Patcher v1.1.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
2- Patcher/(64-Bit) EDRW Patcher v1.1.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
3- KeyGen (Activator)/EDRW v13 Activator v2.1 - De!.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
3- KeyGen (Activator)/EDRW v13 Activator v2.1 - De!.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
ReadMe (EDRW).txt
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
ReadMe (EDRW).txt
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/setup.exe
Resource
win10v2004-20240221-en
General
- Target 2- Patcher/(32-Bit) EDRW Patcher v1.1.exe
- Size 147KB
- Sample240223-rw7aksbb35
- SHA256 8a66e54eb6a022eeb9063bf8182d3d1dee11aa6990742e25ccd64cc5b7dbe3b0
- MD5 d0d44869d0b87fd8e960951687417cc9
- SHA1 8594dce79ce8745f09498ae5c5ca539d30fd1db6
- SHA512 fe96f3d56345bd6dd9543ec259a6c7b646c44501029b5503453993646404c9dd805d7cae7f73d6e0cf29ae07edf950fefdfd7ec298314af962df2d4f8ec2c67a
- SSDEEP 3072:UEz43VWFR6FJ/V1UM181JjYrAAI4b6CMi23Bq793+MWyt:UEN5Jt4b6CM13BqB36I
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2188 (32-Bit) EDRW Patcher v1.1.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\dup2patcher.dll
- Size 83KB
- SHA256 f9585de5b2442e841fabb7f4a61dfafe28849fbece57a372a9110137ecc4a6f8
- MD5 4d9ab4032aff2644ce0d1e54d3de1d7d
- SHA1 153a01ce5abfb7f3febbb048d621053664159d6b
- SHA512 cd376badd4a67d8b96701508c899a2e3fb71811c0b65e3760defe3b0ad9ee51b48c82464ad64b8b29d401174740c5116f6b8007e265d08373959fe9bba1cee0c
- SSDEEP 1536:P/Tilc2ldltF9j6RW8HAI/1lxC+oU0ODbaKPI:3TYc2ldltF9jWW8HAI/1lxC+oU0ODbaK
- MD5 SHA1 SHA512 SSDEEP