a1ae3bd40b816aac7714d71150febe200c2ed230b21613c43ff6519c51cd2531

Analysis

max time kernel
298s
max time network
173s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
drw.exe
Size 2.7MB
Sample260807-g4xe8syfka
SHA256 a1ae3bd40b816aac7714d71150febe200c2ed230b21613c43ff6519c51cd2531
MD5 2d66b40fb667406a1dee67e5c9266bc5
SHA1 a3873f47bdae1bce395e502d2ec52e6c95ab4f85
SHA512 93183e55f1d00bffb3ac58ea49fa609da19f913ddd83c4930c323128368a40c334039d77e23b61339ebe335f53a72ee39dbd6eb03db7bbb31b6aeb1f88ae61c0
SSDEEP 49152:b/ZqT/Zm/AnmcBtJ3oXvjEWZB26jYoeAjQwaRSDjRlVuB7nDpORDKnR:tu/Zm4nmcBtJ3oXvj72X+1aKOpqDKnR
TLSH
T15AD5333B0F5499B3D9457EB088CAC0F59AB9BF0B9A55650B7203BF8B0F04BD14924B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4748	EDownloader.exe
4428	InfoForSetup.exe
3540	InfoForSetup.exe
1244	AliyunWrapExe.Exe

Loads dropped DLL 6 IoCs

pid	Process
4428	InfoForSetup.exe
4428	InfoForSetup.exe
3540	InfoForSetup.exe
3540	InfoForSetup.exe
1244	AliyunWrapExe.Exe
1244	AliyunWrapExe.Exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4748	EDownloader.exe
4748	EDownloader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 4748	5976	drw.exe	89
PID 4748 wrote to memory of 4428	4748	EDownloader.exe	90
PID 4748 wrote to memory of 3540	4748	EDownloader.exe	91
PID 3540 wrote to memory of 1244	3540	InfoForSetup.exe	92

C:\Users\Admin\AppData\Local\Temp\drw.exe
"C:\Users\Admin\AppData\Local\Temp\drw.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=drw.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-3797332335-34111092-3597280141-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"999999\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\EDownloader.exe
Size 1.2MB
SHA256 05e8c9dc10e5086032ecbfbb9e93bd9004dcd525593631e0c41c7b4d5a7519a4
MD5 dc0658cd11a1475603e8581bc2156723
SHA1 26d326c75686f630f5bc1478b2ffc10b9a86b95b
SHA512 87238b8e7f26aacc9e1221b8837dc27318c074f6bd5fea0f8fb7f4f1d2ac77df8067404b9a060a613ed9709dfedb60c290305d858b8b2390ad6e475c45d1f88a
SSDEEP 24576:1KOWhEXwOWtskVf7L3GfSb/YaMCazmfsWEGewmJd2pUt9UwSezotT:+E7rlP2sSewoiUDFNotT
TLSH
T1A9559D91FBC7C2F2E14711B4287BA73E5D3A7658032486CBE3942D194B217C1EA7D39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\English.ini
Size 3KB
SHA256 a6237a06959f1bf65fc2b3e77ae509d3bca1713340227b7fbb66e28da4f84404
MD5 514c7cfa0101eae70994afd3fa7801c3
SHA1 bd6249fe023542c5be1180b76343e4e220be7148
SHA512 d889ffd4495ec023394d1170b97bf40fad9ff202b36500fe85d6620cc08e3c42580caf6992c09817646a93d253cfece8e94b66b14e6eee5cefce3f91b5fa4919
TLSH
T10381A76A6716D2783EC30397D2977D51FF71D4D8729A20299DDB80C6438D958233B1A3
MD5 SHA1 SHA512 TLSH

Submit Download

InitConfigure.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\InitConfigure.ini
Size 4KB
SHA256 79d7d5f6552bdded7a3a89ad5458a63dbe49ac0f6ad59fae523648aff5141d93
MD5 59585ee1cca2648ad7a242ce5d531e00
SHA1 d888f8a988d53d581c43b4d5a2b7cb3612d550f7
SHA512 bedf4c3bc52e88148c36c98d8da600a9c029705202c60ee3795805b3874aa97a04990ee852ace9db9bb85ca613d7a35fbaa98db4ed49a4a7a018b412be3ba367
SSDEEP 96:w+Pa4QWnrxj0yJLVDLGWCiB5LOQbwcx1vg2Mim7+rUUM0b:Ba4QWnrayJLVf2iB1O+wA4imKUUJb
TLSH
T16A8193CFC91082596CD9069537C9AA586AF342DB06D0DA44F5FD2C0E7B849122BCF22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LanguageTransfor.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\LanguageTransfor.ini
Size 325B
SHA256 373bec6e7976324ff879c2988bab772c69336d7bcb9a32386a6021568350a824
MD5 ffe692a67871185785ec705b1cc12c81
SHA1 06a12bffdff33024a7b8798bdcdcda1fd7255bcc
SHA512 7ecdb5a4e625370888fb3a827cb668e934e29ca764177fca04e4eb620bec2b664fe498c0e9e73288bf977006eaba9618a4dc5a169e0fc5588a0874d9e6bb6c50
TLSH
T1E0E07D64FB573051AD9CB8CE380ACEC0439E14AE9A6307E741DD26CC4B57E383AB4520
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunConfig.ini
Size 1KB
SHA256 0d378e3d9cf20e00de6c0d00968580d5a0d1d9e380ddf1bea3c2b6a22cff455f
MD5 5c950fbd81030641f2d7705adccb85fe
SHA1 b0765727cbba74f65d63b4b551fa914be8f32f37
SHA512 3a1b04ddce76d586213b91cfdad6cfcbd8a1df12c675859e7b90163c6075a8edc2db8e11a358de351c460850063b1fdf9041d940038c8a46c2a4c18d9e70d460
TLSH
T13631052626F910149073BF46EFE8E5F69B6778112919885940D1034F4DE6780DA23ABF
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrap.DLL
Size 430KB
SHA256 2298f674ebec38c6509a1f32f61ac3a792dcb16d442f815d2f61b28cbd5c6802
MD5 dbfd89e3ba69e5446501ec3902e4c731
SHA1 f2864b2a383d80e55cc748d93f8351053af8068c
SHA512 c2ab13fc6212b4b6af73b5c3e66505f9255b986c3ded3e1f23ba90ea32e1585f7f9a127f21601aab54749c2ced8b4b0693d8166679c3a07d15694e249783aa5f
SSDEEP 6144:CVnCGWx/n7W+nf9fWEXTW52N14jpHDFceXQVpWCfYwT5WmKtdmfE+D14fEJSgQ+5:MnCRxV1FK52N1IpDJJmdTMYfxQgX
TLSH
T175944B61BD41C032F9D600B6E6FE4FBB5D2C9524132890D3E3E649B97A604E3B63974B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\AliyunWrapExe.Exe
Size 151KB
SHA256 6de6406f7fb0624ae0ea4c6c99a0ca2691b58d26081d880b19843c66658b28e4
MD5 872f9f5d5d72baac65ae4ac103163eda
SHA1 82815de0a3405dedce155fc4943598a92964faef
SHA512 09b34a490250ddd7d6d0ca1ba5e4a890d705c15002b55efddd3d974c419fa9e6798c2de34697440d155997c012be9000cad747bdf3152e08a1c0f2d0dc41ac2e
SSDEEP 3072:DbtACHRwRvDRhV6l/CeMGM1JdCnbi283+MXWWxewdOQwJ/:9fuhQdC5onM3DeGT0
TLSH
T1F5E36C1075C1C032E5B709319EF89976597DFD300B249AEB73D80A3E5FA46E0AA31A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\DataFile.ini
Size 974B
SHA256 67fd1b00ce7b909598ce5e5dc41dc9791ab5257bd92d3b2fb6efe3e9952ca750
MD5 0b1c14853d5db7c67edf688e66f20733
SHA1 485c5beabee8bcf32523ad053cc5675f78d5d8c1
SHA512 e85a42d776f292b36b35947f51ddaeeffb87ca3035b2766483d845904230c6815bad085bf43288cd0fe896c210fa8772dd3468c95a5294fe3dfa4576b9393d3c
TLSH
T1AD11A02A19D810A6B6BB661ADBE4D822972778C6184CDD4D24F22B4E44D5102E453AFF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\InfoForSetup.exe
Size 98KB
SHA256 ffb1e43877061763c0e08da1651958c6471323fad1a0a1c16138b69c21b98703
MD5 8b5c21563e0aee02ee605a62ef72744d
SHA1 42e3b3b99305580e076d264a695456476cdc986c
SHA512 27f2171514c829b6f47388897928d87b6a9829c900dc7737ef5bf37b2ef8ecb97514d5d87fddf7f4a62b60dd8032e258922484080da6cdb83cb90440be2b07ba
SSDEEP 3072:M5trgl5JKj4voShF1nIKtmfmKPbHxzdHSZE:UgTLl18xHp
TLSH
T149A37C10B5C2D831E573193678B4E9A58A3EF9111F609EEB339C012E4F256D06A36AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\VCRUNTIME140.dll
Size 78KB
SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
MD5 1b171f9a428c44acf85f89989007c328
SHA1 6f25a874d6cbf8158cb7c491dcedaa81ceaebbae
SHA512 99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1
SSDEEP 1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
TLSH
T12773AE22F0D180BFC566857452BAEA036B3D9A510FE18EDB6F986D841F79BC1E730217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

downloader.ico

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\downloader.ico
Size 65KB
SHA256 aa4df8b6f5bc456121eafd03857098e56a4357a2bae7cdd651cafd2cfd78ac7d
MD5 e7ba7ed202773284c3dd85e4162c38d3
SHA1 7467da2d1455c5af1419da18feae2cb5c3558a3d
SHA512 87dca3bcef8b309a501ffe3eefb5b20194dcf3b9729f024577f3d57dc025643e556c5c01797606483590e5dbd28502425c5f603a0077cc2e4561dddd0322efc1
SSDEEP 1536:PEJFQHJXdXtM6LJWEXIVUpjSICCIV1A7vku:PEJFQHFltM6sEXIVUpjfIA7vN
TLSH
T17953BE915B05D808C9884930CCDEDEBCA764FC11D8DC265736A2BF8F38A2AC9D61761F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\2.0.0\2trial\skin.zip
Size 509KB
SHA256 bf227cea0494ae6dc777b8342a473449ee5479e5169c3112ad94ccdba3b861aa
MD5 5640294cd03bf7f6491cff398827a854
SHA1 7d0c5bdd6ce2b3810bb00c5d121fac7bccf94297
SHA512 a4195c9452d2f30e5511ca4c5ec739a8df0bebc1761d92c14693f7f414a9dd924ef770d819f43e832debed10eb9980e3b77b795e85368fadaa4ed246206e97b7
SSDEEP 12288:WNyH7hnP32oaWfFf697KiklE8r5RIb02K9hsa3Ant:cO7lvEqY97Xk+8rgbCkt
TLSH
T12AB423C7D36819F5CAF87238068312C16833574B6C717A0E856BCD624AF2FC549E6BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads