2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5

Analysis

max time kernel
898s
max time network
431s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voicewave_installer_20260714.17840894148733b5550674.exe
Size 3.6MB
Sample260715-e1bm9abw3n
SHA256 2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5
MD5 2e192fbc97db5f2644cb74624550bb1b
SHA1 af0331038b1d263941b1602cd726807b4522a4d1
SHA512 453c2a77007b2d9052acf42817c25443a6ad2126e956e18c1025132213f45cb5fa439a819135d812bc117159690de833e9620b9889e7f3f9bc0d086730d099a2
SSDEEP 98304:TA4HXq5Y68xio+Q3Wf8q6rVfV9WxSKFG8ZCv4:XHxiQ3s8qUxV9WxAmCA
TLSH
T1E406231AAE63DC8FCF626C34B5520C1D1A3D5ABFD0124AD317BE1E384C693827AA7553
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
6120	EDownloader.exe
4492	InfoForSetup.exe
2496	InfoForSetup.exe
556	AliyunWrapExe.Exe
5108	InfoForSetup.exe

Loads dropped DLL 7 IoCs

pid	Process
6120	EDownloader.exe
6120	EDownloader.exe
6120	EDownloader.exe
4492	InfoForSetup.exe
2496	InfoForSetup.exe
556	AliyunWrapExe.Exe
5108	InfoForSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voicewave_installer_20260714.17840894148733b5550674.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6120	EDownloader.exe
6120	EDownloader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 6120	5324	voicewave_installer_20260714.17840894148733b5550674.exe	86
PID 6120 wrote to memory of 4492	6120	EDownloader.exe	87
PID 6120 wrote to memory of 2496	6120	EDownloader.exe	88
PID 2496 wrote to memory of 556	2496	InfoForSetup.exe	89
PID 6120 wrote to memory of 5108	6120	EDownloader.exe	90

C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260714.17840894148733b5550674.exe
"C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260714.17840894148733b5550674.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=voicewave_installer_20260714.17840894148733b5550674.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-2370214745-1838013427-2987045292-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17840894148733b5550674\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:556
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe
Size 3.4MB
SHA256 09fc252661481ea65e23c90babdb7801be6b77dc5db3095cf726372d0d80ff0a
MD5 83aaf734d620f4a1b4aab6d5f0cf6819
SHA1 e6e2d128d260c9a52e0ee3cb32023ddb9d1b9d66
SHA512 22c34ed55fa0149f72bf2ad4751eef52897bb5dd4f300cc5d0cbadc566c33b7907114cca567ad12edd58c1aef811014bbbe81599ccb9e28a2af8007347e92df1
SSDEEP 98304:H+gzEdPtI8TzKPrqSUiyk++U3AfqkQHLtrBUnKR:eVbNSokU3Oqko5rBU4
TLSH
T108F5E12176A28037F5B304B59D7F6B6ED46CBE32072494D7A3C40E2D0A71AD27A32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 27c809bba8a0d5de3e8f555b4dd5d949d81310c331c3388359724c937122e265
MD5 051340ad67b1eb02f05ba6a537ef89c3
SHA1 d42adc458908b63d9d3fe68a4a01492ce848046d
SHA512 e351bcb13b545b50eabc9e3f325d52796deabc613640833ebf8df753e996de82d39b7d1b448f24f37e5a85e37f57c3bcba22ae6f0b79db0c8004dcd9660a4d1f
TLSH
T17E316D2B35F910089073BF4AEFE8D4F7C76A79116949D85940D1034F49D5680EE13A7F
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrap.DLL
Size 482KB
SHA256 544b2bf4ccdaeaf6ce8f3e0d4faa98281ad17f65fc2defaec915d16d320dbda6
MD5 90a1760397db7be8a7a82b82cfb72d2c
SHA1 774f0a6c25a61b0e3c2c80fc4bc5830d4c77db55
SHA512 29439377953068d75902c205f2db5f40b0bc9925e6761082dcd0da722ed1301df8d1dbe93f8f0e301322a4e6c680139f0c21e0974387d3c20a00c6ca947b9ec4
SSDEEP 12288:laK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Pas:39DeuBc/IPu8WMAF0Pas
TLSH
T1FEB4BF53AA80C1B3D18A017516B6B77B2E39A7355364D8C3F3D81D785E207E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
Size 107KB
SHA256 2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3
MD5 f9a22315670147c91e2e044403f8e791
SHA1 a0407ef0c23fc82c831b2e2fef48048e98c17e56
SHA512 865f71d0ddc09506fea34aaf481f79469c7fbcb523dcf4f6967a4f55ad4d17907e1294c21f5e7dae96844d54a5e16174579b11256c8836ab3c17403f9a259d7f
SSDEEP 1536:M554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU+/I0:vswTbD6LLraInhEdlg5BJU+/I0
TLSH
T107B37D217980C032E8A714738DFCDA699A6CF9311B5598C7B3C84A6E0F617E1BF35267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 700B
SHA256 6e37654c02a5ecfcd8d37cceab6531c8762423d6eac425706c96087a9aec6951
MD5 3d7df7064e5d31a72b0844d10516624c
SHA1 682d20e5fe20e0e585342c9df19ebaeaac663604
SHA512 3a95e483901e5714eec1534e02cab5d3236924b8111655ffedd4b138e74042d123061a275e95220f7fcce759bdc46644f47f52140681c74ceb8c05ccfa1a6819
TLSH
T15401D16A6AE81159F5B36A2EEFB4C825573B78C54C08C58C10E22E0F08E0A11D5233BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 598B
SHA256 a1d61fdf9985289c43d7c286398003fb13e082bbc4d8f35b7920921c1bbd2d39
MD5 193fcc3d25b622c9e2481e2e03db2533
SHA1 6a6c29057a45f3784876ccc4fd03f799144c977d
SHA512 f9d0d16e1d2d8fecfa8f2f77d0b8e18a99d7cb1020f8b359df2a2bd8654b06f5436d554b029d9edb14a7c00a4140ff34dcf5632502956e2a09a120ad3d37a09b
TLSH
T141F0B4775AEC205AB8B3266ADFF88877532778C5185CD94C64E12B0E00F1002D0532FF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 de06d605883fcc35de0c3e1db7bb3534e26cf0bd1d7a4b9d2af5a8521f066efa
MD5 2d353c433b883648ff85fa630a3e1733
SHA1 18d91090e6fda635a57b9c52a2b12acfc5bbc933
SHA512 86d1487ff9c6458f64109bcc404c03333368d88a805d897fd7828977a002a84db86f4066356b8598aa26b307eee21b2cd3f749e7101b2bec69ff1ff5d933e1f7
TLSH
T1B021C0666AE8115AF5B3662EEFF4C936533B78C54C48C94C14E22F1E04E5501D4533FB
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
Size 65KB
SHA256 b7e0bb05d2b6673dae04d3a008b516e3c2803e6d388dcae3405b94e7f7ddcf3f
MD5 f20f89694c7ff9e0c84d8b55ddabcb5b
SHA1 1ac86fa7877c09e9132958171260c12ef289fbfb
SHA512 3d27047339e6c70876778a90bdde84dd758be397dcc1453f26d4dffc4d6eec378b58eb88ef88c0eba24fb8c43099e8d50d8dbeb26dada81f1a3216d27d039ca8
SSDEEP 768:AVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbVTkK/Ws5ALH:AECwXShvLYIE3nnInie2khc50H/a
TLSH
T12F638E127890C033CC5A88B55868D7A09F6FAA6217E494C77FDD16BD4FA13C06F3936A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\cacert.pem
Size 232KB
SHA256 5a03d0cf132b66659edcf43c087c4cb1b3647f341ace02dd84c693c804a0a5dd
MD5 3548d8825b94ecf3cb6fc617e32e8989
SHA1 54edbb080d5505f03dff5bbf71efa31794d0e064
SHA512 fc5a5d81a9d052701ddcbf62437a7c64813d22a842468fbaa530ff3a5541cbbf2270b885974627c468d6af217806e39ea20802e7a3b79ee76e9700fef56fa024
SSDEEP 3072:VhGvwW6Jj7ITWYv0yoVH283rz9WqIAsjjg4DsUQS88UP4TFf3xVOVkCC554jMN/V:f5W+j8chWf8xyvp5iIzB9Nxza/MT+K
TLSH
T18434BF9BCF526C5918D3E094C9AB025DD81E4263DDDB78A32D0A3801DF89B3E66FD48D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\libcurl.dll
Size 359KB
SHA256 683bb7b131576fe7bc8efbd3c5b00b9ca5fd91b763774f51f4fb71a746cd896a
MD5 2fc4f35490fa25908c2963a0fa586cb7
SHA1 ba80bfe3ef6eb07f060100f231491de63001d35e
SHA512 fb23525ac35f66cad45dc505f40553b1a1556752b18ff2259f11515a33546b5d6f2c44d9a2e7dc3f2d7336e656ade9ec9291434c5e038bbddb696c055d89dc7d
SSDEEP 6144:lj9yPDdfoOVjXiNATUHtpt71vYSriO77CjZh9mXoSsXzimTt0V9nFEzl+/y:lj92GTLRrii7Cth0AXd0V9FEhCy
TLSH
T13C745BA2FC018032F6D21175E6FA9FB76C6C5125271AD0D3EAD044A49D749E3B23EB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\vcruntime140.dll
Size 78KB
SHA256 44aca93d4a046252c60f0cbbe5259d9509b912aa07e5379b2cdbe842700c7e9c
MD5 b8f25e1833429fd8f529c5fdd2a4f3b4
SHA1 7ae7ca5e695e6cdb590022a0602879bc2f56a65a
SHA512 077007237e7ddfd280dd08f145a0f3c775c461bbf61574cbefc4f7c29ba6308c16b52da94dc8f78345fec1cdac25f5e604b890669124a7e38e205e54a68729e7
SSDEEP 1536:JbiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL+/o8:liyLyt/xcRjWazaecbGCu/o8
TLSH
T1A9737D4335E082B5D9AF05F4D8BAA70A9A7DF8500FF26EE76B944949DF60AC09770307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\zlib1.dll
Size 84KB
SHA256 b4ad7ba65fededaa11befbfcbd688a1da96031c88e2324075b42e5057f04c6b8
MD5 089c6e80c5d506ca980f4fe2f6747dde
SHA1 f59e5441c43b008ff49a67cdc9960d33be5425f7
SHA512 dec10d21a229557624b47e9d2e3e011dba592bf9e31d67cd25b6237ba23cf6661ec4475559d06be6a0447260d142856bafbc57cc3cabb96654762dc03feec4f8
SSDEEP 1536:F2lVj7uRxDXVJ3DD7fGcg/hiOrN/GyrZlIOsIOI/QxVDIJ/D:FQVjSHTXbg/hjdZviI/QxVDIJ/D
TLSH
T19783AE82FAD053A2D9F6007490F7877D9A3670214B97ECDBE38DB66849113D1AB362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.ini

Path C:\Users\Admin\AppData\Local\Temp\resource.ini
Size 237B
SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
MD5 b452f9529880ca4668ce2f603ab147f6
SHA1 5fb906044b5e01e482b7ca6739a27ca317b3bdae
SHA512 0965f455912e62ba2c40134d48dbfc631f383db7b71033743c8f06533ab7b338e8947478002da3fa92390f15eed0d90d251aa6b8ed7d49e33a30563aa392bf46
TLSH
T1A9D0A7BBCB4A00FFCE0083C839002F97F703491A4423CD1098A01A08F02281AE8878E7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads