d8d92ee5158c4c68222c6f8c9d34ba5cdb0ea559e991a1a9d8c34e81656cdfe9

Analysis

max time kernel
149s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/downloader_easeus/1.0.0/46free/EDownloader.exe
Size 1.1MB
Sample260415-ffd4baat3s
SHA256 d8d92ee5158c4c68222c6f8c9d34ba5cdb0ea559e991a1a9d8c34e81656cdfe9
MD5 9c95e3ff795e08a6be4c10b86b008b28
SHA1 5063feaa9a8fb7e3423adf7177994882f1bc492c
SHA512 0a8df53e036a134539d55b9b57c4839be2f250044c63a712aa8bc0e6dda97ab16e1206c77172416ad124f238e154c4f94ee48e8b3aacf040d0008b385d0d16fb
SSDEEP 24576:9mBQxvBQklFCaj5IeoR7TK1cAfeerSeU1qXXkWa:9muxvBQk3Cc5XoRd9OSeU1GXkWa
TLSH
T1C4358D6176818132F6A300B19D7FF76E546CBA35072990C7F3C45D2E1A70AC27A3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2080	EDownloader.exe
2080	EDownloader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4628	2080	EDownloader.exe	80
PID 2080 wrote to memory of 4872	2080	EDownloader.exe	81
PID 4872 wrote to memory of 4472	4872	InfoForSetup.exe	82
PID 2080 wrote to memory of 4776	2080	EDownloader.exe	83
PID 2080 wrote to memory of 4964	2080	EDownloader.exe	84
PID 2080 wrote to memory of 664	2080	EDownloader.exe	85
PID 2080 wrote to memory of 1840	2080	EDownloader.exe	86
PID 2080 wrote to memory of 4572	2080	EDownloader.exe	87

C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EDownloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /Uid "S-1-5-21-3847269522-1618051987-1942096715-1000"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"\",\"Timezone\":\"GMT-00:00\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
    C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"n\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1yqyi2epbbxvx.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1kp3984eicvmo.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"2\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:664
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d26eyml8eh90ed.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"0.00B\",\"Elapsedtime\":\"76\",\"Errorinfo\":\"1004\",\"Result\":\"result_fail\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EasyLog.log
Size 4KB
SHA256 3e8e92d968ad0efbfae9d082c660fda3a84ba9cf0ad679ed21d9d0305c957bc7
MD5 54f00c47164de921854a83c8f9caedb0
SHA1 883986080fcfe7cad735f796e8909581b53a1fb5
SHA512 f3fe802a041b6aa86cdf95795584492b505a43878f151d4c38ac9b25bff95a06f72b05b340b5f584105aae92749ff93bd097d567d305b0c07e5135273b7a2c9c
SSDEEP 96:XRgXEOIUhsKFeC1zzKrRX41K2qYKPScflP1mcDo7KMb1OOK0Wcq1ZgrKIZ1E7Guk:hQxXFvgrRoo768HU2oo6qH3qMcb
TLSH
T1FF91AF4F4F43D227A538474056CC2AC192E3E38355508059BBBE0F4FBDB60A99BE9AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 0883256cc7c4c5915cab82826c784710e97acd31ed092827d62e83465a716028
MD5 d30bb8e8f9314de0c038dff1772f7747
SHA1 67ab50c43e7f821ba64ecc5721b74c63dc6bd393
SHA512 c67f70dd2219b6be1a7a34a24abfd53d67fc8f3d23c42bd2473a204cc411722d5f1658cf864d02f7f2933c56c98074a6941920fdc6b8b1879f35eac3d08c8c93
TLSH
T187316D2739F910089073BF46EFE8E4F7D76A78106949C85940D1034F49D5680DE13A7F
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 142B
SHA256 94c979771c6bcffc7030ba6b3a189ad0ed853fc685458b59ffa3c723ebd731e4
MD5 309430cdca6f7417c8c708f238d184b3
SHA1 e465e4f43ebad0e65c7dc6b705be1636022653c0
SHA512 28b0b659a29186173091ff6c51894aa9aaafe8f27a1283515191304f969b4a6d5096cc11633a7cc2e5c4b25922c3e2a57c190f1b74632899afb5ece4ff32d407
TLSH
T1FEC092B32BCD100AFC26742ADBC4D83B2B1B70D8408ED80D60E0331B80E4801A2271F7
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 698B
SHA256 679ef15aa9d1cd2f10ebc6396eb74006b358e6d0df9789c7e0fd3c8b6605421f
MD5 14ca36e3333dca82492918c4dfdf12f7
SHA1 7ebadf30688f7760d2a0a479161778937abbaca6
SHA512 784092b6e65f3defe620aca358a76509ecd1cee7f84c9633b4d8ead42dce8f3349e3eb6f23b935bac0edde2b0d12edd8945c0e098509063be500b933515c01d7
TLSH
T1A901D19A66E81255F8B3A62EEFB4C926533B78C44848C58C10E12E0F08E4611E1633BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 554B
SHA256 2d0ae3262969590bf75eebf3ae13f3367fcba81abf97338e30631d5f399c7b73
MD5 7a12f6020069bfd772e284e0863110b3
SHA1 23e5dddcfef1b00c49d50568ddd0671420f75421
SHA512 3c6db7e92cec43059c6a6eeb7a4307e9018c1512dc1c07e88f74da3e54be4705a54b88a112b6ca5c7d9b35c12c96017cfb58f3af2b94e0321781615e3b42c380
TLSH
T196F0E2575ADC1089B863721BEFF8C836172778C5189CD94C20E13B0F04E4001E0132FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 720B
SHA256 c75766c4f10f3f4776c93a6f182062a75ec6fb573e22a4d45fef4392f07ec5ed
MD5 ecb8ce23b5c43ab604a25955f28ce50f
SHA1 1ba6ef2179bcbdc901f78ab863cbf7c9481dd02b
SHA512 68bfa1ca2d50f041bc8b29180ecdc3bc6c338ea5cb725bd2b9699e1d97a79221d8ea9390586e9bc140a8a01efc2f37c6cd1ae545ccc30274b316d3ce4fa7614f
TLSH
T1B901265A6AE91519F4A3A52EEFB4C83A533F79C45848C54C10E11E0F08E4601E0533BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 720B
SHA256 ee524015c0aa39470225cecf3600a79f2a156735c0dbafeab5181e9ed7332017
MD5 c0d9e2a3bb9638cfe8a33b27625f2d75
SHA1 469de5b742edf7c6b355fd7b92fcf691541c7e61
SHA512 53bd064e945086dae7797bc42fdfe60e3019a4628ede8e849a0d46680da15a5e7d52825f9ba6b3f0ccc60292d8b442ed8a57ea02e024fbc437424a951d3e02b8
TLSH
T1F301D65A6AE81655F5A3A62EEFB4C835673F79D44848C98C10E12E0F08E4A11E5533BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 b8e243d6b78701c8bb151e5f8ef478e6b56efd829c1d4b19c3f50b26690f20eb
MD5 9a1c8b6574c722b15de1c66d4527c85b
SHA1 26386241bdba62e432aedbc3774d37b64344109e
SHA512 9b4822a8793b768247f979b0547502d654d02aa800c5f392c9374e0954546659aad91d7b7ed9ca2aaad5ba07dceb162540465ddea47f103a2d994954c798b860
TLSH
T1BE219F9A6AE8155AF4A3A62EEFF4C936633B78C45948C58C20E22F1F04E4611D0533BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 618B
SHA256 ffa8cbac9ec85795cf41680b11547c065519d634fd688b046f7993a6abd4cdd7
MD5 bc5e11449a6a0de0b3135d9d553bfaf2
SHA1 67c9ec9e3cf85231295aa7e4f26400aa78724e62
SHA512 2503ef69dd72d9b1a102fd4ba278b5d09956e76cf78db35f98131766b3505b0c949009aba5c95f3419f784ff63aaf325045b3741be79ef727c734729d40ea441
TLSH
T1DDF049AB56E8205AB863652ADFE8D92A633B74C49949C98D20E22B1F04E051181133FF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

resource.ini

Path C:\Users\Admin\AppData\Local\Temp\resource.ini
Size 237B
SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
MD5 b452f9529880ca4668ce2f603ab147f6
SHA1 5fb906044b5e01e482b7ca6739a27ca317b3bdae
SHA512 0965f455912e62ba2c40134d48dbfc631f383db7b71033743c8f06533ab7b338e8947478002da3fa92390f15eed0d90d251aa6b8ed7d49e33a30563aa392bf46
TLSH
T1A9D0A7BBCB4A00FFCE0083C839002F97F703491A4423CD1098A01A08F02281AE8878E7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/664-195-0x0000000002550000-0x000000000260B000-memory.dmp

Download

memory/1840-249-0x0000000002780000-0x000000000283B000-memory.dmp

Download

memory/2080-75-0x0000000000FE0000-0x000000000109B000-memory.dmp

Download

memory/2080-50-0x0000000000FE0000-0x000000000109B000-memory.dmp

Download

memory/2080-46-0x0000000000FE0000-0x000000000109B000-memory.dmp

Download

memory/2080-289-0x0000000000FE0000-0x000000000109B000-memory.dmp

Download

memory/4472-47-0x0000000000BE0000-0x0000000000CBF000-memory.dmp

Download

memory/4572-253-0x0000000003000000-0x00000000030BB000-memory.dmp

Download

memory/4628-5-0x0000000002BC0000-0x0000000002C7B000-memory.dmp

Download

memory/4776-113-0x0000000002D40000-0x0000000002DFB000-memory.dmp

Download

memory/4872-26-0x0000000002820000-0x00000000028DB000-memory.dmp

Download

memory/4964-154-0x0000000002590000-0x000000000264B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads