bdb74a31956e7c2ce7a3c6344ac7265d84b735c1038a390168f01d6d9fa43b3a

Analysis

max time kernel
136s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
filedata (4).exe
Size 2.5MB
Sample240507-wry6mabf28
SHA256 bdb74a31956e7c2ce7a3c6344ac7265d84b735c1038a390168f01d6d9fa43b3a
MD5 6e3bc255dc7b79e452c66610c741eb95
SHA1 972d9adbec19dd1277b4329fa13641847ca18c87
SHA512 8f79aff54a92394ee1098c92b7bb0880369cdacf0aa482475edb47857838687eb06ec2f33075eb2343c54284d8cf8ccf6e50cbe4a96ed36f63321796eb1f8562
SSDEEP 49152:e/jU67vjsddEhjFGNS9LXQOjOQKK6bxM1vehddPa46JFUxkVxq6ZBcMucAtL:2U67vYUhjjV5OdbOUhDPWTUq9cMPOL
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3228	EDownloader.exe
1660	InfoForSetup.exe
4984	InfoForSetup.exe
3328	AliyunWrapExe.Exe

Loads dropped DLL 3 IoCs

pid	Process
1660	InfoForSetup.exe
4984	InfoForSetup.exe
3328	AliyunWrapExe.Exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3228	EDownloader.exe
3228	EDownloader.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3228	4788	filedata (4).exe	85
PID 4788 wrote to memory of 3228	4788	filedata (4).exe	85
PID 4788 wrote to memory of 3228	4788	filedata (4).exe	85
PID 3228 wrote to memory of 1660	3228	EDownloader.exe	86
PID 3228 wrote to memory of 1660	3228	EDownloader.exe	86
PID 3228 wrote to memory of 1660	3228	EDownloader.exe	86
PID 3228 wrote to memory of 4984	3228	EDownloader.exe	87
PID 3228 wrote to memory of 4984	3228	EDownloader.exe	87
PID 3228 wrote to memory of 4984	3228	EDownloader.exe	87
PID 4984 wrote to memory of 3328	4984	InfoForSetup.exe	88
PID 4984 wrote to memory of 3328	4984	InfoForSetup.exe	88
PID 4984 wrote to memory of 3328	4984	InfoForSetup.exe	88

C:\Users\Admin\AppData\Local\Temp\filedata (4).exe
"C:\Users\Admin\AppData\Local\Temp\filedata (4).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=filedata (4).exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-3906287020-2915474608-1755617787-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe
Size 1.2MB
SHA256 823ab6955052ef34218559b53d4f15224b5a850b532672fa33a7634dc74981dc
MD5 8a250a75859fe52116e706a640e6d77c
SHA1 473c36d9d80173636faeeb0ae4ae9e047e4e9d8b
SHA512 4b519b1de8f6647a5cbbda11084d096e8bbfe8f694f4fda0e0f244b477f3f15c143254b044b046302ac79b136377894027d9baa2d4ba67ed38f5a55f480a44b4
SSDEEP 24576:JisJdAcuXY/WQjkLxNEl5DYjwuoJ039NzO0lQHoR8lOuLkdNoQv:PjYzhQHou8qkboQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\English.ini
Size 3KB
SHA256 a6237a06959f1bf65fc2b3e77ae509d3bca1713340227b7fbb66e28da4f84404
MD5 514c7cfa0101eae70994afd3fa7801c3
SHA1 bd6249fe023542c5be1180b76343e4e220be7148
SHA512 d889ffd4495ec023394d1170b97bf40fad9ff202b36500fe85d6620cc08e3c42580caf6992c09817646a93d253cfece8e94b66b14e6eee5cefce3f91b5fa4919
MD5 SHA1 SHA512

Submit Download

InitConfigure.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\InitConfigure.ini
Size 4KB
SHA256 3833439cf03c0151a53b05e080878d39c36c28f68cbfcd2b6673a7b4acb3bc0d
MD5 b71a433376606884d121f5017d0b58f2
SHA1 338c2eccc9d45aea410650302dc2d6ed5c27b24d
SHA512 8b4ac6c2eddcc774eae8224dff2e3a618a041e0dc0241cf8f469ce53e771da28bf9836df46aeead0162172b58b67b71007dfc1bcee05d8bfde5a41f2beacd32a
SSDEEP 96:w+Pa4QWnrxj0yJLVDLGWCiB5LOQbwcx1vy2Mim7+rUUM0b:Ba4QWnrayJLVf2iB1O+wA2imKUUJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

LanguageTransfor.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\LanguageTransfor.ini
Size 325B
SHA256 373bec6e7976324ff879c2988bab772c69336d7bcb9a32386a6021568350a824
MD5 ffe692a67871185785ec705b1cc12c81
SHA1 06a12bffdff33024a7b8798bdcdcda1fd7255bcc
SHA512 7ecdb5a4e625370888fb3a827cb668e934e29ca764177fca04e4eb620bec2b664fe498c0e9e73288bf977006eaba9618a4dc5a169e0fc5588a0874d9e6bb6c50
MD5 SHA1 SHA512

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 3671f9d5354c3903d8311e2a641297c33729bfdbfbad6d442a0b5ca69fdbbd12
MD5 7655f9a3b8c092341faa3abd8c6c1743
SHA1 c00f712f2e74f7d68d2e31cbc4c2823605a661c5
SHA512 bbabd32f59f951517dd7c0bdaf7601ad120038f2720153c8b8746b0db9f9f832cfb16b872ff8276ff38f74ebb9a748bb17768000236bb22f4b7b078be90e0104
MD5 SHA1 SHA512

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrap.DLL
Size 482KB
SHA256 265170e701ec453b13249e7a4e4f401b87fae79442cce77060213ebcd03828c0
MD5 58968e221f2522d98dbfe7574d0c44aa
SHA1 424b55216f2c832202c01363e013546380f5312a
SHA512 9bba6ffbec9b6d3de7b530b056098465a54b66494db7e7ca82e8c98802fb5a1cb500f5d505387f2a33fb9a42a533d5838b1125ef14afad11285410652c6f07b5
SSDEEP 12288:YaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Ps:W9DeuBc/IPu8WMAF0Ps
MD5 SHA1 SHA512 SSDEEP

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe
Size 107KB
SHA256 cdc9ee419589b8e378b030a5180b12cf4e1fc2fa132dbaf0e961adbe3c782e55
MD5 f3b9a2d94682fee26fc079ba1e0fb040
SHA1 ff9e89fbcb6939095ecfa34438d9e6ebf9ad6fb4
SHA512 40baa3d59eb931eeab583ecbd4526031bc8d455192d69c3f87b9220ebaab194a2922e4a3e9e36db3a587f56961c0686b81bcec8382ac02f968f31b566581bbbd
SSDEEP 1536:A554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAUH7jfrxZM:TswTbD6LLraInhEdlg5BJUHXf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\DataFile.ini
Size 554B
SHA256 b6a1f9abd7e1b4713a6ac275e750b3357d6f476bc2e1ce1a5eaeaeb2ae81e7d8
MD5 50ab43662482db5ae1e220671a6d491b
SHA1 90e2d9e11ebe3489617f336b05f75b8341b9c99a
SHA512 94fadbd5902f3c6291528ef0c4f64d76bd71002bd8069febb778cb893798ea277abb1f542ee21b1031d971a11c60ddb03384f5992f960ba096114c22495e045f
MD5 SHA1 SHA512

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
MD5 SHA1 SHA512

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe
Size 66KB
SHA256 505ab42f0f376a4d8576bbec9cfdce43deabe168356dee760000319a73e72611
MD5 99891aaa0e15b2a514a4ff5c9ec03f4d
SHA1 faf215763908a9a6b8413c7e40293fe4be9bfe7b
SHA512 36f6d66987506a938faa7503e0fa3a6cf76aa9ca6a30ea7cb7e80d058cf203eae152ef97b2329ba83bb18fc70430a2e00e9aa1f408e94b132813b4bf741697de
SSDEEP 768:CVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbCYiHDLlGAMxkEy/:CECwXShvLYIE3nnInie2khc50k7jex2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

downloader.ico

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\downloader.ico
Size 65KB
SHA256 aa4df8b6f5bc456121eafd03857098e56a4357a2bae7cdd651cafd2cfd78ac7d
MD5 e7ba7ed202773284c3dd85e4162c38d3
SHA1 7467da2d1455c5af1419da18feae2cb5c3558a3d
SHA512 87dca3bcef8b309a501ffe3eefb5b20194dcf3b9729f024577f3d57dc025643e556c5c01797606483590e5dbd28502425c5f603a0077cc2e4561dddd0322efc1
SSDEEP 1536:PEJFQHJXdXtM6LJWEXIVUpjSICCIV1A7vku:PEJFQHFltM6sEXIVUpjfIA7vN
MD5 SHA1 SHA512 SSDEEP

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\skin.zip
Size 1.4MB
SHA256 a0951464134e2af94ecd389ea9c0f3d784bae909f60eb2f45d7764b4dbde7a73
MD5 784c6f9b53521f4cb115532f49b67a36
SHA1 7dcd0e24b7940156fc5be4edb185a57a030b45ef
SHA512 88851e60a1ec3974558b45e422b2a6b412a2a87603e9a1a61ba5491d2c8475c269f29164dd25ac7a3c72d0ad190437e0dc93c02c6a9f2c85ba599c89ed315f21
SSDEEP 24576:ieUyKyJthS35e64nQFQBKkou5O7lvEqY97Xk+8rgbSQj/4DTFHtkr68ft8Zpy:5U5ypEd4QAKkA5R+AgmU/4HFNkr18O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads