9be5bdef234c774ec89d1ba7fcae64e834ee744f57815034e38829b427595933

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/downloader_easeus/1.0.0/46free/Arabic.ini
Size 3KB
Sample260415-ffd4baat3s
SHA256 9be5bdef234c774ec89d1ba7fcae64e834ee744f57815034e38829b427595933
MD5 553ce6d3c612b834c4725c42dddbbd8d
SHA1 dfe03852d9238413ed0488d2a2d11109cae01d94
SHA512 b55917fa624b6cab086fd8d6477e82306de66b891b66d3e0967db62e1b5657a1e6b33949bda0e63cfab0fc4ab959534344982a7767199ad65abd996ae0657424
TLSH
T1B171F1E24E3840743B9D8D2AC2E338A8ED727C63D68AF47894C7555156C7919F3AD332
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3056	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\Arabic.ini
1⤵
- Modifies registry class
PID:4800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-1-0x0000015F60B30000-0x0000015F60BCE000-memory.dmp

Download

memory/4800-0-0x00000159AE0D0000-0x00000159AE101000-memory.dmp