d8d92ee5158c4c68222c6f8c9d34ba5cdb0ea559e991a1a9d8c34e81656cdfe9

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/downloader_easeus/1.0.0/46free/EDownloader.exe
Size 1.1MB
Sample260415-ffd4baat3s
SHA256 d8d92ee5158c4c68222c6f8c9d34ba5cdb0ea559e991a1a9d8c34e81656cdfe9
MD5 9c95e3ff795e08a6be4c10b86b008b28
SHA1 5063feaa9a8fb7e3423adf7177994882f1bc492c
SHA512 0a8df53e036a134539d55b9b57c4839be2f250044c63a712aa8bc0e6dda97ab16e1206c77172416ad124f238e154c4f94ee48e8b3aacf040d0008b385d0d16fb
SSDEEP 24576:9mBQxvBQklFCaj5IeoR7TK1cAfeerSeU1qXXkWa:9muxvBQk3Cc5XoRd9OSeU1GXkWa
TLSH
T1C4358D6176818132F6A300B19D7FF76E546CBA35072990C7F3C45D2E1A70AC27A3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1724	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1592	EDownloader.exe
1592	EDownloader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2532	1592	EDownloader.exe	85
PID 1592 wrote to memory of 5048	1592	EDownloader.exe	86
PID 5048 wrote to memory of 812	5048	InfoForSetup.exe	87
PID 1592 wrote to memory of 2152	1592	EDownloader.exe	99
PID 1592 wrote to memory of 3808	1592	EDownloader.exe	101
PID 1592 wrote to memory of 1608	1592	EDownloader.exe	102
PID 1592 wrote to memory of 2728	1592	EDownloader.exe	103
PID 1592 wrote to memory of 1724	1592	EDownloader.exe	104

C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EDownloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /Uid "S-1-5-21-2023547815-1162023398-1465618254-1000"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"\",\"Timezone\":\"GMT-00:00\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
    C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1yqyi2epbbxvx.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1kp3984eicvmo.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1608
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d26eyml8eh90ed.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"0.00B\",\"Elapsedtime\":\"51\",\"Errorinfo\":\"1004\",\"Result\":\"result_fail\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EasyLog.log
Size 3KB
SHA256 681394da4418f4c1a2397761d02d011f4dff150fb0f0ff90af8ae7aec96d9fbe
MD5 a8f2dd0eb6cbf9b3b64297f51ec1da38
SHA1 0c56ba5f6c3d218c4c0ad92a8425bbbc20661f65
SHA512 d95a66ad2bf9393a8611e123812ab2b515361793829f42de2ce31eba52ca784879c5d3e8f1f094630931db20c4ef11611eaa78da6d38feddc5bb03bcd6247fd7
TLSH
T18E61AA0F8F82D62BF635A66005C859E006D3E386546481E46F374E0FBD760B96BE5E87
MD5 SHA1 SHA512 TLSH

Submit Download

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EasyLog.log
Size 3KB
SHA256 7d5f18b9208dabe0600167cda0634a47e5bfd106bafc48b4c9ad131e6b42bf4b
MD5 6cfa125b422c3cb861d1094365cd5cc5
SHA1 4710e1e4e8c6eda1ff38002e417e970d5c56e622
SHA512 9a91eeed034444ae092ed84fe2734f7918acbea32f176285f91d0f0a620b7def6f5da2046c292a291eabbbc6e4a11b2efced11841cfd7626c2164ff7b21f88b1
TLSH
T196718A0F8F83D62BF275AA6045C859E002C3E3465564C1E46F374E0FBD760B95BE5A87
MD5 SHA1 SHA512 TLSH

Submit Download

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EasyLog.log
Size 4KB
SHA256 9a2bb48bb2ea2078785dc447293482f29b90ffbde267da8349c567eb8e13021d
MD5 47cb67b913e0a85fa558ddbb3106f9ed
SHA1 ca000b5c1687801c891ed5b8811902b6c66fc639
SHA512 763377a4e28e4027e577e1217470c35f4727db1dfcd8190fee30da714d0eac0a6c2da049ed86911c4c048e8be0bf780026fe9535a36c47f9ba6ade9e4abf110a
SSDEEP 96:78iSTKJb17uKrVf1LsKR81P+GQKARE1mv7Kt81BkK5GB1y7cO8PKb:F5brhVKYIAqw2eL5iajb
TLSH
T1B991AB0F8F83D22BB235AA5045C86DD002D3F386586481E46F774E0FBD760B857E5A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EasyLog.log
Size 2KB
SHA256 4d64cf7b450a3759c8d31c5342542a7be1c492bc5b198e4d0dfd32ad6d26645a
MD5 9c1ac698da25d703bb54e8e97f3465fd
SHA1 dca8d8752cc9e8f4c790e61fabbddb36c1bd1efd
SHA512 4757d4ab8de5998935c6883f52424da21bb8eaf45a4c648c385b2bff04ac5d84d57593b50e0d0b9a6f8229039c6d245de6a8bd3092dd19d025de53c2c9c1133c
TLSH
T1AE51CD0F8F83D52BF675A66005C859E002D3E386646481E46F370E0FBD760B96BE6E87
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 8fdce277c72acf79e063b1a720bf9ac3237225f12a4d1b0babd0a607eea5083b
MD5 e73c51e93a3d99a0a6940e431000e01d
SHA1 6db91ccac72d1ccab3e00b9385b4224505c4c8fc
SHA512 113ea31e4a5bae13234c18f921b2a2c0c176f1b809908e08a2849c15b11318b70982ffd6186147666ff4bf48636b082a4a77603debf6b7c05300cc6b2f0c7b2c
TLSH
T11F31592B35F910089073BF4AEFE8E5F7D76A79116949C85A40D2034F49E5680EE13ABF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 554B
SHA256 2d0ae3262969590bf75eebf3ae13f3367fcba81abf97338e30631d5f399c7b73
MD5 7a12f6020069bfd772e284e0863110b3
SHA1 23e5dddcfef1b00c49d50568ddd0671420f75421
SHA512 3c6db7e92cec43059c6a6eeb7a4307e9018c1512dc1c07e88f74da3e54be4705a54b88a112b6ca5c7d9b35c12c96017cfb58f3af2b94e0321781615e3b42c380
TLSH
T196F0E2575ADC1089B863721BEFF8C836172778C5189CD94C20E13B0F04E4001E0132FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 720B
SHA256 63d871cd5efce712d22267ec18a60fb33cc2b7114fad790bdf45d74048066c0a
MD5 c8755577ac69d36cb827dca8240da0c3
SHA1 01147c9597dd2cd79c0f56c3b6b11ce5a792e3b2
SHA512 3f3b68ed413b10adcee25a00cc871a682a1d0ff22c47d1fefc293f6735d1b959e6fb883143a99b4d0f147b8a7971f9e9139127f176a0010661d116c26a22299d
TLSH
T14D01495A6AE91619F4A3A52EEFB4C836533F79C4084CC54C10E11E0F48E4601E0533FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 720B
SHA256 2826489ae3cffc05af030bb0df6add5a68994779129d45a4abda283021bed4c4
MD5 575b9298f4c7ca738f88f24b142f0bea
SHA1 db40436d12ffe15fa5347d16e7d72353b25a4d36
SHA512 d085da23fa5c9cb865213c56696e748ad5d424db4b52fb982767bae28501adc875c7093d00fea9c0589fd8bfad66ac9c9d745d85a87ddaf390792e4ce0b69ade
TLSH
T17801F95A6AE81659F5E3A62EEFB4C835573F79D4484CC98C10E11E0F08E4A11E5533FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 8052f531c363b74d7544abc0b90238e1e94bf3cc8e9d8b80701d44190d2299b2
MD5 eb4b4b30f74aceff2579950cf309bc5b
SHA1 c328f59a4eba49e4e961ae2d8d81ec46c1d46263
SHA512 38e9f9cd6708ce9b085fbec6d67c43652869833017d3b2936ceee980a3d3de42c43d2fb711c9b83c5f735649a4d7b6132379ec0c89bbaed6703e9ae1ca57b684
TLSH
T19041E59A6AE81559F5A3962EEFF4C93A533F78C4484CC98C10E21F1E08E4A11E0533BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 e72980568fd40c7642358dafc7855fb62769713675ae7b2814b2ee45a2ce4e2c
MD5 c9f119536e97ff156ff8694263604c3c
SHA1 9dff959f891e8d0fe51afb31307ea82df013d313
SHA512 5d6251f705aa0d77e336278dfb2e8b7d1b48848a3b625846eec18b49501207a0f5746d65e3012a14545323f4a0c9b61ba5bae0d5c4cd18cc41bfb673cda5ad26
TLSH
T1C121929A5AE81559F5A3962EEFF4C93A533B74C4584CC58C20E22E1F08E4A11E0133BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 720B
SHA256 b4459beb5c48cf2c1623c89214776e84a3fa9b82b4f460c3fe6c970f6c3180d9
MD5 1a05c6ba97ac652768ad61715df741ce
SHA1 48e8dfabdcf478cd6960ecb9e306b585f281e26a
SHA512 44d3630a2e4836be8295650b4aae2bb9fdebba088c33143a82f330478e451a43cfa8d14d9e3095602bbb9ad9a790ea1783685afb0dbcae65a5c7baf4a2ee263c
TLSH
T11A01265A6AE81619F9A3A52EEFB4C835533B78D4080CC54C10E11E0F08E4A01E0133FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 698B
SHA256 cee054e244dd2cdc0e5dd659727d1780d9ee0b37eccac601f223ea65646a73c4
MD5 73f298e472287e60fe37b0b8d2b32be3
SHA1 26d16a6d224ef42ca79ba8e445ecd6fc58815c5c
SHA512 6e2c3c50c9d213036b7deca41c3d19d5e5971e6815812bffd01d92afeef11f32f376aa840104965c9f22b56d7e63787cafe2729818032fdba090ddb4a32a81d7
TLSH
T15501F49A6AE81259F4B3A52EEFB4C936573B78C44C4CC58C10E22E0F08E4611E1133FB
MD5 SHA1 SHA512 TLSH

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

resource.ini

Path C:\Users\Admin\AppData\Local\Temp\resource.ini
Size 237B
SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
MD5 b452f9529880ca4668ce2f603ab147f6
SHA1 5fb906044b5e01e482b7ca6739a27ca317b3bdae
SHA512 0965f455912e62ba2c40134d48dbfc631f383db7b71033743c8f06533ab7b338e8947478002da3fa92390f15eed0d90d251aa6b8ed7d49e33a30563aa392bf46
TLSH
T1A9D0A7BBCB4A00FFCE0083C839002F97F703491A4423CD1098A01A08F02281AE8878E7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads