Overview

overview

4

Static

static

1

TB_Home_Tr...00.exe

windows10-2004-x64

4

TB_Home_Tr...00.exe

windows11-ltsc_2024-x64

4

$TEMP/down...er.exe

windows10-2004-x64

3

$TEMP/down...er.exe

windows11-ltsc_2024-x64

3

$TEMP/down...ap.dll

windows10-2004-x64

3

$TEMP/down...ap.dll

windows11-ltsc_2024-x64

3

$TEMP/down...xe.exe

windows10-2004-x64

3

$TEMP/down...xe.exe

windows11-ltsc_2024-x64

3

$TEMP/down...up.exe

windows10-2004-x64

3

$TEMP/down...up.exe

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 18:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMP/downloader_easeus/1.0.0/3trial/EDownloader.exe
  • Size 3.6MB
  • Sample260905-wvb59sgk2z
  • SHA256 6d28d0f41f8f2cfaf93645e8db0835e38b3d1bb78d1908790ff52f6caf66292f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EDownloader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
      /Uid "S-1-5-21-1738198120-2966725515-3980530802-1000"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3324
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
      /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5492
      • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
        C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunWrapExe.Exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5036
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"m\",\"Errorinfo\":\"4\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=467\",\"ResponseJson\":\"{\\"check\\":0,\\"msg\\":\\"version\\u4e3a\\u7a7a\\",\\"time\\":1788632083}\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • System Time Discovery
      PID:1940
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"­\",\"Errorinfo\":\"4\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=169\",\"ResponseJson\":\"{\\"check\\":0,\\"msg\\":\\"version\\u4e3a\\u7a7a\\",\\"time\\":1788632147}\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • System Time Discovery
      PID:1120
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"ConnectNet\":\"netOK\",\"Elapsed\":\"n\",\"Errorinfo\":\"4\",\"PingHost\":\"hostPingOK\",\"PostURL\":\"http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=&lang=English&pcVersion=home&pid=3&tid=1&version=&tmpTime_=358\",\"ResponseJson\":\"{\\"check\\":0,\\"msg\\":\\"version\\u4e3a\\u7a7a\\",\\"time\\":1788632192}\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • System Time Discovery
      PID:4420

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        EasyLog.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
        • Size 2KB
        • SHA256 9e3a9ff06ba3f81da279eb2ec9b6de57d833a4fb1b07c3397fc8c3ea1ad78128
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EasyLog.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
        • Size 3KB
        • SHA256 581b7f646864f33d00e26a4df9a141c6ba7e598334e9d79178132484a67e1e4d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EasyLog.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
        • Size 4KB
        • SHA256 36d6025ee234256055ac4fc051578ce5d266a6f13c15a059e2189a92e5c61128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EasyLog.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
        • Size 4KB
        • SHA256 3648f9ff39347cde5f0f0b59abaaa6a464d8063949c911a5be2d75b2da457b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EasyLog.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
        • Size 1KB
        • SHA256 caa9ae051ca0c55462017ea2159cef87dc03c7d475333979ccfea426ac8cbaaa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EasyLog.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\EasyLog.log
        • Size 1KB
        • SHA256 83cde9a041d63193db0e5862e4f3b7495757f9e56979a2b20b527447a35cb8fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 ec9c8d7a07fca759e86fe5c634b656b4b7127616a3a5b4e47e9a4c94cce3bb62
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 1760b0b30809675b0a3a887c257a6b21b65de824e91d5e8d56652736aa163f81
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 1KB
        • SHA256 f5e8d2ff558ed626fcc70b9204a481b1b32e471a0ef60b09766b2fc0dc36f21c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 1KB
        • SHA256 4ee8c6db856b95ed1bf27181d757650dfe36e21ca47fe83ddb34bffa67339695
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 1KB
        • SHA256 d0a859c6165a0b8b20620871ce305093b4cae0ddb1f417f3302467adfb6ed7b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 1016B
        • SHA256 6ee1a0339fc03f91b5b00d378155da7baf558766e3a972dcf10453055cb50826
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\DataFile.ini
        • Size 88B
        • SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tempInfo.web
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3trial\aliyun\tempInfo.web
        • Size 1B
        • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
        • MD5 SHA1 SHA512
        Submit Download