6d2d20f4f89b01d146407f5569aa75758ace2a1796457bc1bc3fe13082c9150c

General

Target
$TEMP/downloader_easeus/1.0.0/46free/EDownloader.exe
Size 1.2MB
Sample260701-pgmlhsdy5m
SHA256 6d2d20f4f89b01d146407f5569aa75758ace2a1796457bc1bc3fe13082c9150c
MD5 12aeda75bcb5b9dbd13bd85c0181aca9
SHA1 964d92810d8f42bb16b63a37406a4d9457ca6f27
SHA512 bf53d9b800d0b71c0a5b4305ca0ce661af0af0ab1e4a0c35dbdc6febca219ecf261886831254e592818afa90618a2ce2f8f6050a370ecbcb6a848bc7206434bf
SSDEEP 24576:+0TDvES51nIHFifKcXEp/YV2tlUkLXcYnbqrQBuVvgC3m9Pf:t3bXGllXcYbbBuVvgC3m9Pf
TLSH
T1BC459C60EBD381B2E09704F46DBFB37E99397664031585C7E3D01D2A0E616E2BA3539B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5696	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5124	EDownloader.exe
5124	EDownloader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 6084	5124	EDownloader.exe	89
PID 5124 wrote to memory of 5440	5124	EDownloader.exe	90
PID 5440 wrote to memory of 5824	5440	InfoForSetup.exe	91
PID 5124 wrote to memory of 6740	5124	EDownloader.exe	92
PID 5124 wrote to memory of 5696	5124	EDownloader.exe	93

C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EDownloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /Uid "S-1-5-21-2900715619-172032027-1873877232-1000"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6084
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"\",\"Timezone\":\"GMT-00:00\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
    C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6740
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
  /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"0.00B\",\"Elapsedtime\":\"1\",\"Errorinfo\":\"1004\",\"Result\":\"result_fail\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\EasyLog.log
Size 1KB
SHA256 3c9a5715830ffe7f70f38e7f1ec4703f8cede1328fa9e767cdfbe26b505e69b0
MD5 0fa6774616ab22d0b346d6556b98cf6d
SHA1 1209198ee408e2d6995c082330f30f425072b68b
SHA512 88f6dc848f4eebdaddf620a3bb242ed17d51db7b5a8db2b3d63686ab10984959d1a8b0830dc0d57805c4bbaecb5c65acf023d7431ef2a0d8ba193f7e6e55453b
TLSH
T1C941270F16E19D3F75C24795264A2BC00297A7C281B0C12D7F664A0FB5B904ABE1A3E7
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 6ee433e20b3753bc366bb1073c520c8c27ffc784a72bd332e0cecfe7820edf73
MD5 067da7dfd58b81996546553d52072981
SHA1 5dee82aba0ed474fd773ab49606b158266c15d75
SHA512 e0e50ad6311fbe23057d75c2dee4fb1f04c6bdd7e7d3ef3c806f5f227b5f6ce3e7004514e603a8680e9afa759a7ab63523194b9c8634a9a505c237b9b3452123
TLSH
T1E3316B2B35E910089073BF4AEFE8D5F7C76A79116949C85940D1034F49D5680EE13ABF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 554B
SHA256 16c18a189f858c860b65fffb6a5b0d28c969fc14c6a2167f9c6cb80b0bbf9bb7
MD5 a84fc28edeaf5092f3e0ae5fc0140ad3
SHA1 ec2d2737b8ad01a0d4406e8ee557210a10a9fcba
SHA512 8289e57711aacf40be171c542e02b63f0ffa43d2b63e3e4480336090e976f325e76ea493dc7de337482c526ecfffb5c770e9387c609ddd483c5065e370e019d1
TLSH
T187F0E2575ADC1099B863721ADFF8C836132778C5589CDD4C20E13B0F00E0401E0132FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 9c51f479e2d3540333a4634c23a0110ff7d295088e7f14d74f5a35b9c144381f
MD5 9fc2df338846001e52869c27be941bcf
SHA1 57c3a49de84e048430097210ae40e8481ab27e8f
SHA512 01c53724ba957d61a4180be7c26ef23e818d5335ad2ed20295837f85278b1f3836992819b84410c91f36024e9e080c741a5fa0684689e907fe52fb5e043a1b55
TLSH
T18F318F9A6AEC2199F4A3662EEFF5C93A533B78C5594CC98C10E22F1E04E1611D1133FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 aec4c607989e25f88f0e4ff8e8e2e208cb49d7d619b78f4a8cc8f4482b93f1bd
MD5 98593bf0f786e20032bfc6a113160e11
SHA1 714f067fb5683519805b074dbb488605f751678c
SHA512 d54931bca590af1005f2ac3f08fc1468985ef4da3e235fa7482444a9342081ec0162da13b5beef322d4bb5dddd44e1634bfa1f64f74b017ac37ef238606796a1
TLSH
T167218E9A6AE82169F4A3662EEFF4D93A533B74C58948C98D10E22F1F04E1611D1133BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 616B
SHA256 927f73f04c56285211291cc9269a142c3da36eb41a97e06d8c82d7e54f1945b4
MD5 9569bcb40b278447a4146f6d655012c0
SHA1 4a50b03f0c5cec3ceac8f89997c8b4817c341d0e
SHA512 f7eea8310a143ca6fa3fa9bce64d3ef409877c7d70349321939c71c29eb91c827e8bb8ad58f2117a28dfc904aa19f5855e1cea77d5b78834c0ac1968479df2ca
TLSH
T1E0F0499B5AE82059B863662ADFE4D92A533B70C58848C98D20E22A1F14E051191133FB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads