496ec9237125a1ec2a4b687e1b1b2f07f312e296ac76f1d917c53b6ac6095c3d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voicewave_installer_20260414.17762284925202b5140975.exe
Size 3.3MB
Sample260415-ffd4baat3s
SHA256 496ec9237125a1ec2a4b687e1b1b2f07f312e296ac76f1d917c53b6ac6095c3d
MD5 6e59a099311a0a59a905be0e9122f5e8
SHA1 46f96f1014cfc47cf4b26f45a20da8730c98ed1f
SHA512 6536e24d3c1eef46610a99e9059c5bcef8346b3f1139471636768f925d4337809948f1c2c4ce8594e1e2bdff1eb81e22d32cb2f31a912684b210fcdb781bc944
SSDEEP 49152:u6pNQRLNp4VGnNcOoHI3ECEw4PlDnyPYOD/rxWPNmYYMblUxst4rqPdPzHvdvC:u6wNFuOoo3EfwuutD/rxWlm/qP7E
TLSH
T139F523195EF3CC8FCEA22C38B9834D1D5EBD96BBD0124AE3127A2D394D657427997023
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
3476	EDownloader.exe
2448	InfoForSetup.exe
4968	InfoForSetup.exe
4444	AliyunWrapExe.Exe
4808	InfoForSetup.exe

Loads dropped DLL 6 IoCs

pid	Process
3476	EDownloader.exe
3476	EDownloader.exe
2448	InfoForSetup.exe
4968	InfoForSetup.exe
4444	AliyunWrapExe.Exe
4808	InfoForSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voicewave_installer_20260414.17762284925202b5140975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3476	EDownloader.exe
3476	EDownloader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 3476	708	voicewave_installer_20260414.17762284925202b5140975.exe	79
PID 3476 wrote to memory of 2448	3476	EDownloader.exe	80
PID 3476 wrote to memory of 4968	3476	EDownloader.exe	81
PID 4968 wrote to memory of 4444	4968	InfoForSetup.exe	82
PID 3476 wrote to memory of 4808	3476	EDownloader.exe	83

C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260414.17762284925202b5140975.exe
"C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260414.17762284925202b5140975.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708
- C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=voicewave_installer_20260414.17762284925202b5140975.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-3119821332-640943685-2562343641-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17762284925202b5140975\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4444
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"2\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EDownloader.exe
Size 1.1MB
SHA256 d8d92ee5158c4c68222c6f8c9d34ba5cdb0ea559e991a1a9d8c34e81656cdfe9
MD5 9c95e3ff795e08a6be4c10b86b008b28
SHA1 5063feaa9a8fb7e3423adf7177994882f1bc492c
SHA512 0a8df53e036a134539d55b9b57c4839be2f250044c63a712aa8bc0e6dda97ab16e1206c77172416ad124f238e154c4f94ee48e8b3aacf040d0008b385d0d16fb
SSDEEP 24576:9mBQxvBQklFCaj5IeoR7TK1cAfeerSeU1qXXkWa:9muxvBQk3Cc5XoRd9OSeU1GXkWa
TLSH
T1C4358D6176818132F6A300B19D7FF76E546CBA35072990C7F3C45D2E1A70AC27A3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EasyLog.log
Size 1KB
SHA256 e263edfe3a895dba77b392662d357c667d89a1f9b45b444925cf45d366b0820a
MD5 dc3f5619904618722107feefe9968188
SHA1 f7831b0af6c62f383d31c9beba502260138fe892
SHA512 7728d8f1c4d84f6765816e5886dca553aecb48e65eb2ecaa0edcec433d7a623e204519bc3f4f197136f5ed0998ec2a4bf44402e23c8164c8fa17acc8ac86cc01
TLSH
T15431CA4F0F57D59FFA7002A049E829A346C2D256A4F445D0BB711B8EBC7907917EABC3
MD5 SHA1 SHA512 TLSH

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\English.ini
Size 2KB
SHA256 1e6f09d26ac1f99c4d3c10af77312e903a56240526247540e6335f79c03567b6
MD5 29f27c125dd3a42c9144c13bfd8c798c
SHA1 fa32c4a20144e1c06145cdb126ed714a9399ca38
SHA512 79ca233945a69a3932c744656f3ddc7f986f2a3a28c5c3e1143e02cb25f0857c4b617af8b706236cdd66e83b17aba71b76a7a3bfd60c3df26d691113ea420397
TLSH
T1EF51B68E9A60A23939C2077286E73D52AD31448556A7142DCCDB61C6238FA4C333B157
MD5 SHA1 SHA512 TLSH

Submit Download

InitConfigure.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\InitConfigure.ini
Size 3KB
SHA256 e581c9491ea380a28b08e18adb46faebf1dcb2df71cf5b6bfd1c04a8a6d5131c
MD5 9e6f14d954eb0046a9727bd3295f3ee6
SHA1 fb7a178698b9dae80a402536814c9a9b0ace40a2
SHA512 9e42ed930bcb979793f205a1980366f5cbd8f5dd32226e405cdf1b1bb205c74ec9d1ce67ef44cab26123b95cf3724a4d55e86900eda30f9ddb6220306443b72c
TLSH
T15361A4CFCA20C3067D8402A527892D997DA341EF0B90C660F2FE190EA78195127CF22F
MD5 SHA1 SHA512 TLSH

Submit Download

LanguageTransfor.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\LanguageTransfor.ini
Size 305B
SHA256 a4433bed3d227249d08d37b84c84a001e443586d5cd2cd63f3fede48d282bae8
MD5 5b9180ca7b92eaf3fc02c35e78e66cbd
SHA1 14a854b2a08a1a4e0eb1f928f85c2e3fe9d18c05
SHA512 12dad07a3136f779774ab8ddab08c6dc2d78d184fe282719179a1be5f5c519e32f86065e8d5cca675345f25c121eba333604ea59de6aa60361d68f4a633db1aa
TLSH
T15AE07214FB17B4A2081C99CD341BC6C183C13CFE12A38B8342E29A881A03EA83A20830
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 e9b9dc552d54abb7c68d9d54f5f32dc4bd99c3efd520e660cf928e0fb1c77e2f
MD5 0026eb68e3c328125ec97488a838eb50
SHA1 95dddac433a3c7297e96c24af360329e85b2dceb
SHA512 cf32029da77d267a9979598fd8ea01995f870a0ee469b49ff1f9ae62ef106970fda504af26bfe1212c5866f89b4946770f354090d6ca9e1eea6a812d6e0fbee2
TLSH
T1B031392739F910089073BF4AEFE8E5F7DB6A79116949C85A40D1034F49E5680EE13ABF
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrap.DLL
Size 472KB
SHA256 3b3ace2f3fa701a69de43492767164a84d3d43eb27f749588294c37113baad47
MD5 c040d867ad50541b173be8485ce9e22c
SHA1 2d25b12416cbc09c72f49dec226764d2a31afb4e
SHA512 5a4c6154aff4fb1e9ac5a71ae1ed8893ff32160116454404811c5881df117c9c7f3310a20ffc218cc7ebd52426467620e6344bb4efce5f532acb5d9e2208f011
SSDEEP 12288:iaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0P:c9DeuBc/IPu8WMAF0P
TLSH
T125A4AF53AA81C1B3D18A017517B6B77B2E39A7355324D8C3F3D81D785E206E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
Size 97KB
SHA256 43a8147cda17098558dac69c204b8b6dbc0c03c372eea719276c8fc946112eb9
MD5 95a8ab3dac26d95863784d9bdeca266d
SHA1 1c4e39914b6e60ad153edea98ad5fc98d9f4e011
SHA512 33b37e0051a79f76a7c6eae1c447b878fd9befb7391595f5d2089a02f013580550b3dafe53d924a81641ac7520653a9a4a995fa638a19ac673f599b04798be87
SSDEEP 1536:d554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU:uswTbD6LLraInhEdlg5BJU
TLSH
T15DA36C2179C0C032E4A714738EBCDA69966CF9311B5599C7B3D80B6E0F61BE1BB31267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 700B
SHA256 dd09e619633b753643545278e7059f4e81a9244a7c67647280137c8e0508ad5a
MD5 d2fc4642828978316f5c927f43016ead
SHA1 610d787e96318a892932d85503c5600c7360c6b1
SHA512 17d60aee2c8d2256759780f2ff4a2c781448bd43a2e66c8aca5ec04d623a67840a2f3ea34e81d0bcf0bc299d1910efdbc8d3cbaae65c91fcd70d5a209c300848
TLSH
T12D01D1AA6AE81155F5B3A62EEFB4D826573B78C54C48C58C10E22E0F04E4A11E5223BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 598B
SHA256 e5b8c5d6fdfbffe8f63729b3250c41829123c2e4a0cd552661090b997647791d
MD5 a91933e03b4bd476f753391a78db86b4
SHA1 f085a9555a7d5eb8c662bf4b7503f6a97792b44d
SHA512 e4b2760d9f6dd34ddb95703cc7a48533c93682d00e76700a67de4ff3e67dceb2590a8e5b98de7bbe52a7db157349833a4621973b28eb46756f001f69bda13bbd
TLSH
T18CF0906B5AD8105AB873A21BDFF8887A576778D5185CD94C20E22B0E04E5402F0532FF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
Size 55KB
SHA256 4aac5bd38cc4872cc751e68e4e76669dafe349b7f03e0e9408001661928b3d09
MD5 a4fe9d915c011a61d83545578ee3f0f1
SHA1 79eab132067dcd21b9c9316a0924dff6228e5bda
SHA512 75a463b813d80f434fe6388ab1422c402f7b81452ac5ac1f1ab9ef9cd8e8dba9d9bc19e39eff4f0357f4ab7c6ce395775635b7a52afab1ff6d325a0176a6ab9f
SSDEEP 768:DVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLb:DECwXShvLYIE3nnInie2khc50
TLSH
T100437C127891C033CC6A44B54D38D7A09B2FA92217B598CB7FDD1ABE4F617C05B3636A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

downloader.ico

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\downloader.ico
Size 417KB
SHA256 ea7130cb4871500d82bb94b0c4b103c118381dedf5f1c3f28bd819621661f5aa
MD5 cf49494e7fa1df1b1b460bcf4b04dcc8
SHA1 b254713ec8d0a90ad2de0c1843ce82292e9423b1
SHA512 5c2e3ae1dd0889552097d10d51eba562569dd00472f991c70ee4c5771f89bd3eeac2dc5d87875c078b6f271e1e113dc42c16e69c43e553c0a5ebb6ec3d5d7af4
SSDEEP 3072:rVP1qzEkpmfm5IVn5rEcW+/vYobiaP2atU/Mn9KaUq:J9QpdIcc1tma+81Uq
TLSH
T1E2943A2EADA3DD9FCFA22C35A9970C29197D4BBBC01285E3157E1D394D69B023997033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\libcurl.dll
Size 349KB
SHA256 7c530ec50f35456e4d95e9fdeea3a6a706936f2de158f856d847c1849075b179
MD5 766a920fc367f2a3702ca2c01ec3c8c8
SHA1 6a61df0c21852b42078a83a983179048d135976b
SHA512 4bb87f4a4487bf8498b5044b8ef2f056cefaa33f67de208169bfce4337a58e4bd57a8f89df37c7268c0dac2b0646d6236465101a550c7f79dbc020f4bf7c768d
SSDEEP 6144:sj9yPDdfoOVjXiNATUHtpt71vYSriO77CjZh9mXoSsXzimTt0V9nFEzl:sj92GTLRrii7Cth0AXd0V9FEh
TLSH
T1F2745BA2FC018032F5D21175E6FA9FB76C6C5125271AD0D3EAE048A49D749E3B23EB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\skin.zip
Size 1.6MB
SHA256 fe46d9c58e4a90a3b9618bd3cdbb956601ae54d586d15a6899d4e52dedc4b7d7
MD5 f960468c6c843d07648d04bee0e241e9
SHA1 8a96bff9b06a9025cdfa8e168c9c06e486ad70e5
SHA512 0074722dffcae440029a2e6e8643ecaa70e086345f7f9af7b1898feb53a42111c1674a50abec6ba1bbdf61316187ea40d5b4128bef55e98812d930c3d3598c0f
SSDEEP 49152:SUiyndm++H03ACEq4dldFANkALtrBUZNd5:SUiyk++U3AfqkQHLtrBUnz
TLSH
T1D07533E3534ADCB9C05696B8B6024255FE39B5CDA2103F8316668C748CA35FCCA5BB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\vcruntime140.dll
Size 88KB
SHA256 09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94
MD5 e4ed441f0f6afb0d8d55af87900ec48f
SHA1 ac5bd77fd06ed29bebceb65371387555658870d9
SHA512 dec6d693aa2d6c043ef8ae35f7f613cf9366aeb8a5903e8e0c54644f799262229b91953c65d39f8535ce464c75bf34b3b23ddb50a9fc5f171d36d6bfa1e4d7dd
SSDEEP 1536:obiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL9Qzv6mzm:yiyLyt/xcRjWazaecbGCWba
TLSH
T173937D8235E482B1C9AF05F4C97AEB066A3CB5900FF169F76B949985DE61BC0D73030B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.ini

Path C:\Users\Admin\AppData\Local\Temp\resource.ini
Size 237B
SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
MD5 b452f9529880ca4668ce2f603ab147f6
SHA1 5fb906044b5e01e482b7ca6739a27ca317b3bdae
SHA512 0965f455912e62ba2c40134d48dbfc631f383db7b71033743c8f06533ab7b338e8947478002da3fa92390f15eed0d90d251aa6b8ed7d49e33a30563aa392bf46
TLSH
T1A9D0A7BBCB4A00FFCE0083C839002F97F703491A4423CD1098A01A08F02281AE8878E7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads