Overview

overview

4

Static

static

1

TB_Home_Tr...00.exe

windows10-2004-x64

4

TB_Home_Tr...00.exe

windows11-ltsc_2024-x64

4

$TEMP/down...er.exe

windows10-2004-x64

3

$TEMP/down...er.exe

windows11-ltsc_2024-x64

3

$TEMP/down...ap.dll

windows10-2004-x64

3

$TEMP/down...ap.dll

windows11-ltsc_2024-x64

3

$TEMP/down...xe.exe

windows10-2004-x64

3

$TEMP/down...xe.exe

windows11-ltsc_2024-x64

3

$TEMP/down...up.exe

windows10-2004-x64

3

$TEMP/down...up.exe

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 18:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TB_Home_Trial_Installer_20260905.100000.exe
  • Size 3.0MB
  • Sample260905-wvb59sgk2z
  • SHA256 29c50df12d761f47182245f86409b4eec4eabd33e92991d4be99a3721ba164de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TB_Home_Trial_Installer_20260905.100000.exe
    "C:\Users\Admin\AppData\Local\Temp\TB_Home_Trial_Installer_20260905.100000.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5912
    • C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\EDownloader.exe
      "C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=TB_Home_Trial_Installer_20260905.100000.exe ||| DOWNLOAD_VERSION=trial ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2172
      • C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
        /Uid "S-1-5-21-189034102-168398478-1159367937-1000"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4668
      • C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
        /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\"}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
          C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4816
      • C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
        /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"h\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=1-100000&lang=English&pcVersion=home&pid=3&tid=1&version=trial\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"3\\",\\"version\\":\\"trial\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"curNum\\":\\"2026\\",\\"testid\\":\\"0727\\",\\"configid\\":\\"\\",\\"md5\\":\\"69D1929727CF09618133E121B9D0AC30\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/tb\\/trial\\/TodoBackup18.1.0_trial.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/tb\\/trial\\/TodoBackup18.1.0_trial.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/tb\\/trial\\/TodoBackup18.1.0_trial.exe\\",\\"url\\":[],\\"name\\":\\"tb_trial_b\\"},\\"time\\":1788632081}\",\"Result\":\"Success\"}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1412

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        EDownloader.exe
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\EDownloader.exe
        • Size 3.6MB
        • SHA256 6d28d0f41f8f2cfaf93645e8db0835e38b3d1bb78d1908790ff52f6caf66292f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        English.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\English.ini
        • Size 3KB
        • SHA256 a82964b0605b60eed9997ea9f3d7bc23c5ad9ff95f083d51f4ebbdb137b88c94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        InitConfigure.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\InitConfigure.ini
        • Size 5KB
        • SHA256 211a2504c0cfe8e28bc32de9fc6065150e1d94b24573a96b43684cb0a1a6d258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LanguageTransfor.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\LanguageTransfor.ini
        • Size 261B
        • SHA256 80193c8d307d982cf45fbf62f0eee3b7ec5522deca8a027155875d610c63657c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 a21433348831c2bf7d8409ec40a89442dbd306f27b8abfcd51e4af2d25b29870
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 d5a99a5a792008c6407f1d9c680a95af7d366d7ebd30e809027aed0e679cac19
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 6c4094d53a0e034af22dfe2c28600a62498379596e462c01ef5f76f3b3f0e7c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AliyunWrap.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrap.DLL
        • Size 467KB
        • SHA256 8c0c911e6a309b430fe696e094fa13dd30bb82c8b6d95082d502735ef373c1b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AliyunWrapExe.Exe
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
        • Size 190KB
        • SHA256 5317d61214feaa01e9b974eb0f2c292b6393a0f742696f6aabdf6fdb3f84059f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 3KB
        • SHA256 35cd683e851f5d4d3036a123adfa102218245143870f68611f2ae1cc77319696
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 2KB
        • SHA256 224806549e76694234dc9aa0b7b5c4e6938ba614794a12603abfc3275adea047
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 88B
        • SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 1008B
        • SHA256 cfc5c6484c423b98d2ec4fa9e783a018c3e6c3634a580d8c21c72163e4159550
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        InfoForSetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
        • Size 113KB
        • SHA256 1ac2a6e10ec9f8340c827c616c479228637b7ede47e1ea5c7d6a0ddd86968dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempInfo.web
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\aliyun\tempInfo.web
        • Size 1B
        • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
        • MD5 SHA1 SHA512
        Submit Download

        downloader.ico
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\downloader.ico
        • Size 414KB
        • SHA256 d0e201b81b74795015e81f284408e6fe933dba25cc00c1c4f5ebed71235d39d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        skin.zip
        • Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\3trial\skin.zip
        • Size 262KB
        • SHA256 102491b2f520aad22196e9794769ada0e63b1149024a0f65e330cf127a90ea6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download