c3c67802707d4fa54e739d198a6438276ec09809eac12b56cb50f26e5996234f

Analysis

max time kernel
149s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
drw_google_trial_installer.5283840.exe
Size 2.7MB
Sample260508-pgldfsb17k
SHA256 c3c67802707d4fa54e739d198a6438276ec09809eac12b56cb50f26e5996234f
MD5 01e5c14127b4997994279706cf4e525c
SHA1 f3742f47454a746fce6ef1fbcbde156d722351c3
SHA512 88e58571454a0d1d0beac50a6f2cffedd6de4cd46d41c661a8de364244413ef7ee37695e0374905a65bc43d812ca5a4f8a1de3f54e10cb2ec417ddeabe8a195d
SSDEEP 49152:2/4LNfyqhSSo9EJ3oXvjExZB/Jaq5OZzpaAjQwaRSDjRlVuB7nDpORDKnb:vLNfysoaJ3oXvjy/JCPa+1aKOpqDKnb
TLSH
T11ED533522F44D835CC057674CEDD24E559BF2E4A2B48EF0B23836F5B1B1AED8C925B88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5664	EDownloader.exe
5036	InfoForSetup.exe
4336	InfoForSetup.exe
4580	AliyunWrapExe.Exe

Loads dropped DLL 6 IoCs

pid	Process
5036	InfoForSetup.exe
5036	InfoForSetup.exe
4336	InfoForSetup.exe
4336	InfoForSetup.exe
4580	AliyunWrapExe.Exe
4580	AliyunWrapExe.Exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drw_google_trial_installer.5283840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5664	EDownloader.exe
5664	EDownloader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5628 wrote to memory of 5664	5628	drw_google_trial_installer.5283840.exe	78
PID 5664 wrote to memory of 5036	5664	EDownloader.exe	79
PID 5664 wrote to memory of 4336	5664	EDownloader.exe	80
PID 4336 wrote to memory of 4580	4336	InfoForSetup.exe	81

C:\Users\Admin\AppData\Local\Temp\drw_google_trial_installer.5283840.exe
"C:\Users\Admin\AppData\Local\Temp\drw_google_trial_installer.5283840.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=drw_google_trial_installer.5283840.exe ||| DOWNLOAD_VERSION=ad_google_trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-3534313381-4287935181-1066995225-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"5283840\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\EDownloader.exe
Size 1.2MB
SHA256 a868d63b166c0db08d1f18585b6b0607c4928a03fad264f9c976ee3cb82b3a29
MD5 1a7df9803f164146e5a3632ea2f05d1f
SHA1 73943892332ecab98fcdfac42623648650e03595
SHA512 dfa483b3262faae6f9f36854ea7284fe85fe9024a239b375a55dfb400b5f358e8ad27cb9edb4fe3a93780fdcf7e54140d3e1b216e60af2d59649f877df074f20
SSDEEP 24576:dWcKazEwxBv53TwwNKuh1k6wmEsmwflmE/bhz2EAv+bCRSrlX:SafV5i2lLbF2/giSrlX
TLSH
T1C5459D90FBD7C2F2D04715B4287BA33B5D36B699832585CBE7A02D195A207C0A93D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\English.ini
Size 3KB
SHA256 a6237a06959f1bf65fc2b3e77ae509d3bca1713340227b7fbb66e28da4f84404
MD5 514c7cfa0101eae70994afd3fa7801c3
SHA1 bd6249fe023542c5be1180b76343e4e220be7148
SHA512 d889ffd4495ec023394d1170b97bf40fad9ff202b36500fe85d6620cc08e3c42580caf6992c09817646a93d253cfece8e94b66b14e6eee5cefce3f91b5fa4919
TLSH
T10381A76A6716D2783EC30397D2977D51FF71D4D8729A20299DDB80C6438D958233B1A3
MD5 SHA1 SHA512 TLSH

Submit Download

InitConfigure.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\InitConfigure.ini
Size 4KB
SHA256 79d7d5f6552bdded7a3a89ad5458a63dbe49ac0f6ad59fae523648aff5141d93
MD5 59585ee1cca2648ad7a242ce5d531e00
SHA1 d888f8a988d53d581c43b4d5a2b7cb3612d550f7
SHA512 bedf4c3bc52e88148c36c98d8da600a9c029705202c60ee3795805b3874aa97a04990ee852ace9db9bb85ca613d7a35fbaa98db4ed49a4a7a018b412be3ba367
SSDEEP 96:w+Pa4QWnrxj0yJLVDLGWCiB5LOQbwcx1vg2Mim7+rUUM0b:Ba4QWnrayJLVf2iB1O+wA4imKUUJb
TLSH
T16A8193CFC91082596CD9069537C9AA586AF342DB06D0DA44F5FD2C0E7B849122BCF22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LanguageTransfor.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\LanguageTransfor.ini
Size 325B
SHA256 373bec6e7976324ff879c2988bab772c69336d7bcb9a32386a6021568350a824
MD5 ffe692a67871185785ec705b1cc12c81
SHA1 06a12bffdff33024a7b8798bdcdcda1fd7255bcc
SHA512 7ecdb5a4e625370888fb3a827cb668e934e29ca764177fca04e4eb620bec2b664fe498c0e9e73288bf977006eaba9618a4dc5a169e0fc5588a0874d9e6bb6c50
TLSH
T1E0E07D64FB573051AD9CB8CE380ACEC0439E14AE9A6307E741DD26CC4B57E383AB4520
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\AliyunConfig.ini
Size 1KB
SHA256 6338c0668cb838e3377f834a750213a4b37ae7abccb3ebad18bce917d9b9bb63
MD5 7b970752b67b5916c9a210b6980fcf5a
SHA1 9757cd3e93333cfa80cc20753c5999e08e6f5094
SHA512 607e868a445b6d5af0c72140ada6d2bdecdfb97dcb627a254f24b80e8562d24a3219cc9ab37f05070d95c7b4f57c2589069cc596e128a0bd77f41ae547cb595b
TLSH
T1C931292735F810149073FF46EFE8E5F79B6778112919885D40D1034F89E5A80DA136BF
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\AliyunWrap.DLL
Size 431KB
SHA256 2ce363aa8f02da478a9d8d1a8066aab283a8430de68180750a3115064acf7e36
MD5 f4b7fbdf349eeccca4a3ffb8bd9719a1
SHA1 5de1c05f38766b3c9c2aaa4c642b3e2bc7d60369
SHA512 4a542ce3dca7ed66af4ee34c06dc6b0e95e05a5d2bf6725e02606ba417cf1c6223eef3cd3fbf40ff9c9f00345964fb78313b3dbe42a3ed5957ced102e944ac52
SSDEEP 6144:5VnCGWx/n7W+nf9fWEXTW52N14jpHDFceXQVpWCfYwT5WmKtdmfE+D14fEJSgQ+U:LnCRxV1FK52N1IpDJJmdTMYfxQga
TLSH
T15A944B61BD41C032F9D600B6E6FE4FBB5D2C9524132890D3E3E649B97A604E3B63974B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\AliyunWrapExe.exe
Size 152KB
SHA256 8ed550dccf95f15092e65d4ff0d7500ce681e1b8dae986fd90c1339b59950a31
MD5 0e1942a55b6af074de8f933b97e053d3
SHA1 42758dbb13a8f7bc0d04a5dec415307ebcf27478
SHA512 8753676014e77f85f5c5f7214d8350c8316d84a3a3f62cfcc078fceb23cd58d8860df366ad01f28c7f2bd3867f8dc2c46b8a7e711be8165419ec0a0df522d845
SSDEEP 3072:kbtACHRwRvDRhV6l/CeMGM1JdCnbi283+MXWWxewdOQMXp:0fuhQdC5onM3DeGTc
TLSH
T177E36C1075C1C032E5B709319EF89976593DFD300B649AEB73D80A3E5FA46E0AA31A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\DataFile.ini
Size 984B
SHA256 90c11c68940f29b5a5dea26ac6ca17fa00153283fcff2ad9aa6409e37a7f5c39
MD5 3b5a820830bc79780ac22d96c3e9fcbd
SHA1 a3be8e8cd8f153a449a9c4bb56472619a8346c06
SHA512 0206ca0cb1a9c93fc3ab1fc01e18df045fd55c82bf4a93b08c959ef7a7430f2c852555f82fb513ecf77ccdc9f9477dc72c7cd2026ee171941c5a8cf6d694eb29
TLSH
T10E11C61B09D810AAF5B7661ADFE88C26975778C7189CCE4D14E32B4E08D2503E013AFF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\InfoForSetup.exe
Size 98KB
SHA256 8f7bbe0d37dc8b57c9877e2febaa334e1d29bae93715f526d536e7dafb0b5dfd
MD5 c9d1d09c06b684aea2f61685ebefabf3
SHA1 99ee650735fd065139995c2d6d1d0c29e6f0aff3
SHA512 1911cb8fc0b2cb424e496027a9348e4e043a8adc0a5cd511412ec67fd0f620c7132ae2ce51d3482de578b322d340c2bbc5cd4ef872d756dd278d7b6d1bad2aef
SSDEEP 3072:OCtrgl5JKj4voShF1nIKtmfmKPbHxzdHeXm:lgTLl18xHt
TLSH
T1D4A38D10B5C1D831E573193678B4E9A58A3EF9111FB09EEB239C012A4F356D06A36AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\VCRUNTIME140.dll
Size 78KB
SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
MD5 1b171f9a428c44acf85f89989007c328
SHA1 6f25a874d6cbf8158cb7c491dcedaa81ceaebbae
SHA512 99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1
SSDEEP 1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
TLSH
T12773AE22F0D180BFC566857452BAEA036B3D9A510FE18EDB6F986D841F79BC1E730217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

downloader.ico

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\downloader.ico
Size 65KB
SHA256 aa4df8b6f5bc456121eafd03857098e56a4357a2bae7cdd651cafd2cfd78ac7d
MD5 e7ba7ed202773284c3dd85e4162c38d3
SHA1 7467da2d1455c5af1419da18feae2cb5c3558a3d
SHA512 87dca3bcef8b309a501ffe3eefb5b20194dcf3b9729f024577f3d57dc025643e556c5c01797606483590e5dbd28502425c5f603a0077cc2e4561dddd0322efc1
SSDEEP 1536:PEJFQHJXdXtM6LJWEXIVUpjSICCIV1A7vku:PEJFQHFltM6sEXIVUpjfIA7vN
TLSH
T17953BE915B05D808C9884930CCDEDEBCA764FC11D8DC265736A2BF8F38A2AC9D61761F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2ad_google_trial\skin.zip
Size 509KB
SHA256 14be9fb17c1da65feab053c5594d8ef48195de66ee6ee40759a62795a485ac57
MD5 7eb6d83983a64c85c6bc6b1cb39be9c9
SHA1 6d020b994592ad852d64592d9ccbeef79abf4895
SHA512 f4f5cc4a0c4e9edd03d0393d3acbbb365773c4b6a246c0e9615079c4c1cf846e45343a8b350458366f7dec7c7389ed71f4482d66652d82b17ed44bf95f830aae
SSDEEP 12288:WNyH7hnP32oaWfFf697KiklE8r5RIb02K9hsa3AnU:cO7lvEqY97Xk+8rgbCkU
TLSH
T1D8B423D7D36819F1CAF87638068302C168335B876C71790E85ABCD624AF2FC549E6B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5664-137-0x0000000002B30000-0x0000000002C0A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads