6d28d0f41f8f2cfaf93645e8db0835e38b3d1bb78d1908790ff52f6caf66292f

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/downloader_easeus/1.0.0/3trial/EDownloader.exe
Size 3.6MB
Sample260905-wvb59sgk2z
SHA256 6d28d0f41f8f2cfaf93645e8db0835e38b3d1bb78d1908790ff52f6caf66292f
MD5 cd7be3f422275931a75e32d7f3962474
SHA1 d5771112fa2993bee5d799856ac4936ab6255f85
SHA512 ebf539fc92b8e00bdaf14668ce3045717c9ef8f084c6751e3e4039a7bf18614561afb82f58fea13553908e2153ba82a52b8aa088170050feeb37bb5544509c7c
SSDEEP 49152:R8G91dvkjR1Raj6iKlo6ftNJdk/w7oTACDUMlVHYkgSUH3szMp/kknVYlZaQdL7X:eG9PUR1Raj+1NDkgUJDUoHY0UXr1W
TLSH
T1BD06BF42FFCB80F2E882457925AB673F1D39A6045324C5C3D7A12D659E316D1AA3E3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3744	InfoForSetup.exe
1636	InfoForSetup.exe
3540	InfoForSetup.exe
4348	InfoForSetup.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	InfoForSetup.exe
1636	InfoForSetup.exe
3540	InfoForSetup.exe
4348	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1064	EDownloader.exe
1064	EDownloader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 4664	1064	EDownloader.exe	88
PID 1064 wrote to memory of 1656	1064	EDownloader.exe	89
PID 1656 wrote to memory of 4584	1656	InfoForSetup.exe	90
PID 1064 wrote to memory of 3744	1064	EDownloader.exe	100
PID 1064 wrote to memory of 1636	1064	EDownloader.exe	101
PID 1064 wrote to memory of 3540	1064	EDownloader.exe	103
PID 1064 wrote to memory of 4348	1064	EDownloader.exe	104
PID 1064 wrote to memory of 2844	1064	EDownloader.exe	105

C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EDownloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /Uid "S-1-5-21-876885714-46325919-1482798410-1000"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
    C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"¬\",\"Errorinfo\":\"128\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=467\",\"ResponseJson\":\"\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - System Time Discovery
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"|\",\"Errorinfo\":\"4\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=169\",\"ResponseJson\":\"{\\"check\\":0,\\"msg\\":\\"version\\u4e3a\\u7a7a\\",\\"time\\":1788632182}\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - System Time Discovery
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"o\",\"Errorinfo\":\"4\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=358\",\"ResponseJson\":\"{\\"check\\":0,\\"msg\\":\\"version\\u4e3a\\u7a7a\\",\\"time\\":1788632184}\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - System Time Discovery
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=705\",\"ResponseJson\":\"{\\"check\\":0,\\"msg\\":\\"version\\u4e3a\\u7a7a\\",\\"time\\":1788632207}\",\"Result\":\"Failed\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - System Time Discovery
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
  /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Pageid\":\"\",\"Version\":\"\"}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
Size 2KB
SHA256 d45211d0cc8627206df8a783e74b404cc56dac5fc1849c0aa72e664de239e9c5
MD5 0ada1da27c6b9c9e45d0a592746dfe26
SHA1 da120a5317028952b4408f153f3a978b8b4da3c8
SHA512 c292f8785180bb0cd4511515abb2837d8f9f0e7bfbf7eb28e81af8807414b19cbea9d202c1147f75e47ba19007fb4e02fd7d249fbc5891a89b9f8184d4e1898b
TLSH
T12451555E47CED1AA1A63067203BDD4816393BBD50260C6AE36B00D4BF92BF69710D76B
MD5 SHA1 SHA512 TLSH

Submit Download

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
Size 3KB
SHA256 7592542d4dc76d89c0e2d1f6eeb248c7a50d06157476380f92086e83c790a0d3
MD5 24cc8fbdb7dc0bff5d2da9f93534bdeb
SHA1 c0237938f639cc21e21e28c4ec7a934bc0e531b3
SHA512 c03a0154583d53c0c7ddff0639341488376ecb651a785a2f78c446d932592366d7ef86bf4207f59daea74257544f67da4a54822e5eb8f141cc0c24264d3d69ff
TLSH
T162618A5E47CED1AA1A63067203BDD4816343BBD10260C6AE36B00D4BF92BF7A710D76B
MD5 SHA1 SHA512 TLSH

Submit Download

EasyLog.log

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
Size 4KB
SHA256 b3e9616ce070ae44fb1fe2897df8d2d053e188b26376a1486af94dcc1019391a
MD5 24a64929ed697404c077350482cedea0
SHA1 69ec130847b7e99e648cf11100221ed069784eac
SHA512 7131980c0305dfe57319144136f20947766d09481720270cee06bb8009f2b48c8d541c06e64e3346aec6abbba6c6011a8d108c3fcaf8b9a30f9c01876d76eecd
SSDEEP 96:bZbtbtgCc6jOZ1CtRU7Q6jOZ1Ct0UhQiO1XkvXnt1Cfyj2R1CFRUpYBjHY1Ce0rC:by7VQSqYLcz3iNxO6Or
TLSH
T1FD819B5E47CED1AA1A63167203BDD4816383BBD10260C66E36700D0BF92BF7A750D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunConfig.ini
Size 1KB
SHA256 6f3e59f9fdd2cfdfda1d1be903efdb5e5aa5f63aee6f20e182610b8bef88fb5e
MD5 4b954525735348799ea4affdd9afc53a
SHA1 081c80ae4ba0175c4651596dce4276335629586d
SHA512 d34474d331cc288cbda05491370a04459ee61392a3f7aa4daf7f8925b49dce4289b62d2ba029c0b535720efb6c5c945e4485a5439b5aa49d278bb5937c9caa01
TLSH
T1AD318E222AEA2118B1B26F5ADBE455F74B27F932390B9C5D40D1030A8DD6A00DD635BF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 1KB
SHA256 3b30c66184c601afbb65ee5ee94a0366b8d4885faa64a6da0d18a6a35c3028e2
MD5 aadffc3a02a9e3a9d17f85c92b70fb38
SHA1 4ad95fa1adb7645e881e13bf83a19a7b0d7403c7
SHA512 3c3e1221d82e8c3112820767767772bea682256797e8e46b3b7dd934edef05ad5ebae0cf4af970e8270fe7d8d4a8a8e1c4ecf2237aea370e1c49aff4e44cb016
TLSH
T1AE31E86925E81255F6F7AA1EDFB88521973B7C850C4CC94D14F11F0E08D6612E46377F
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 1KB
SHA256 1ba0743b5267e76d06a8746fbc8beaa000b0b27362cd1681985d378ab3e11d32
MD5 7a1d508e6a3f7a63b58afbf2270a84e9
SHA1 68a8f452f1a936e563edaa9da150c63b3c1dcad6
SHA512 e179607f08886a70a7100f2dfa31dd0952b78ce50bd87ca9a0cb4a6374efc399b39981490c5c28ce8978f726dd1a5028c7dfeccc242c8c6aa7d40db18b9c9410
TLSH
T16F31E86925E81256F6F7A91EDFB88521973B7C850C4CC94D14F11F0E08D6612E46377F
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 1KB
SHA256 5921cb66503693cc2ed5bfb22e5512f913103423c22263c01aac4dec81ffb535
MD5 26c0ae4255392242ce1977e7d648b0eb
SHA1 08a531dd56b94b4e3f2034d782c1beac7d49d545
SHA512 f626204f5e9fbe0ae2d2b4efdb1ed9dcc8ccd56786041be1fbc204d0a40cc7598dbdb5442ba0b086c5887a3ba9cbd987d22d0c3aa64cf2febf6da045c792c92a
TLSH
T10C31086925E81255F6F7A91EDFF88522973B7C850C48C94D14F11F0E08D6602E56377F
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 2KB
SHA256 8478ee75a264b3a8ba79958966b507523f9a2f7c5b55d4c2287cf37856fbb5a5
MD5 4dd35dca6a76f569f741f915185ffb02
SHA1 b35b408c309015267b35a4b8a9cbcfd526029a8b
SHA512 813cdf826cf79070f14ccd7b0ed229b317f199d358af8df6e74376f96a6058a7ed1bc39c2c8d9bb91292a8ed906d7204c72d1c01897d44de3d654d5693dc3aa0
TLSH
T13251D16A19EC215AF5F7A51EDFB8C922A33B78C508488D4D24F12B0E08D2602E4537BF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 1004B
SHA256 7c8686159a3544f306fe74620c565fa4abf7653ac95755c7e0d615be3d460959
MD5 6183102f12540a2791132804565e8f40
SHA1 d05328382bb3d1492bbd74d86833af54153f1dc7
SHA512 132d5ee3134b49d428d1483ca9e8466080175c095937ee20db87f59ebb583d94a85cde1c647089bb5177deaf4c41f3f5ce5d1e39574fa271bf94e7604ce17ded
TLSH
T13311A36709EC209AB4B7655ADFF8CC22636B78C5188CCD4D24E22B1E08D2102D4536FF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 966B
SHA256 2b6283d82600774817ee03d860d9053e6574800b2ab9ec3c6e31a7f3fb011a76
MD5 8001c3218f660af8c0473ec3537c9032
SHA1 eceea49d5ddc4aafb480ca57fd57a80acee6d7f0
SHA512 4fb61fce84a01e23cbe22a44e3a99c40e48d20af3510e9900f0462a0202c013322d4bed0e067cd76b4d833c0ed498b7fc4fb08275b050cc911de773116671f38
TLSH
T11911706A19EC20AAB4B7615ACBA8CD21636B78C9184C8D4D24E22B1D08D251294536FF
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
Size 1KB
SHA256 68ec615413bc2fdcb945f6c943a57d986d11e1c7025cd398067c84d8828ae432
MD5 b70c73a28a874d063829a4eed719df9f
SHA1 ee61a7ff92cdea7414f7d29ee7de8b7082015509
SHA512 f618bac0b1b44dd293b75bdb3b61c59ebc459ab4a2c89edcf2ee2754f25d3814fe647a507b4e166ff5cbdf14937f12d839bd41476c58ba2df29198183af859c1
TLSH
T18B31D36A25E81256F5F7AA1EDBB88921973A7C840C48898D14F11F0E08D6612E9637BF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads