Overview

overview

8

Static

static

1

voicewave_...32.exe

windows10-2004-x64

8

voicewave_...32.exe

windows11-ltsc_2024-x64

4

$TEMP/evw_...er.exe

windows10-2004-x64

3

$TEMP/evw_...er.exe

windows11-ltsc_2024-x64

3

$TEMP/evw_...ap.dll

windows10-2004-x64

3

$TEMP/evw_...ap.dll

windows11-ltsc_2024-x64

3

$TEMP/evw_...xe.exe

windows10-2004-x64

3

$TEMP/evw_...xe.exe

windows11-ltsc_2024-x64

3

$TEMP/evw_...up.exe

windows10-2004-x64

3

$TEMP/evw_...up.exe

windows11-ltsc_2024-x64

3

$TEMP/evw_...rl.dll

windows10-2004-x64

3

$TEMP/evw_...rl.dll

windows11-ltsc_2024-x64

3

$TEMP/evw_...40.dll

windows10-2004-x64

3

$TEMP/evw_...40.dll

windows11-ltsc_2024-x64

3

$TEMP/evw_...b1.dll

windows10-2004-x64

3

$TEMP/evw_...b1.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/09/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMP/evw_setup/1.0.0/46free/EDownloader.exe
  • Size 3.4MB
  • Sample260929-2eet4swdkc
  • SHA256 09fc252661481ea65e23c90babdb7801be6b77dc5db3095cf726372d0d80ff0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\EDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\EDownloader.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /Uid "S-1-5-21-939655444-3071939294-1401108526-1000"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5060
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"\",\"Timezone\":\"GMT-00:00\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
        C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4980
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4964
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1yqyi2epbbxvx.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3168
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1kp3984eicvmo.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1048
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d26eyml8eh90ed.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4848
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"0.00B\",\"Elapsedtime\":\"8\",\"Errorinfo\":\"1004\",\"Result\":\"result_fail\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      PID:624

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 3765af591bf87dd186963a3ad60be8d5d64da19942c556ce6d615a9305295a74
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 554B
        • SHA256 a4f5c8d645156e2c8fbbc334cce1262ec44fb61a35c2382828a2cd9392b1c80e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 720B
        • SHA256 22a540b310d27026ad251124e9802cb67ff32c6495cbfd2835ba421d647ba956
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 720B
        • SHA256 3e4a4ee2449cf679b4a8f9df5ba37e9c4f8e541c5f754b4c596339cf8f9b3752
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 814B
        • SHA256 4d601f841094476769b2b583f306a0f97e008a11fa2f303ae3ba8023eb8d0123
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 1KB
        • SHA256 aedf7beeb4d6a4b87c8b3ac369ac9675901783a37df4eb3b465a4d8eee2be97b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 616B
        • SHA256 0581a21a34a1e597a28265cc23062fea64dc1736629af5e8ff238cb0afffc867
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 88B
        • SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 698B
        • SHA256 92ebcd25872f98181eb3627e90ea7def730805cb550e556fd272c5cda408136e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tempInfo.web
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\tempInfo.web
        • Size 1B
        • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
        • MD5 SHA1 SHA512
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 3KB
        • SHA256 d82150ed332ac839dc91b6e0763e6659b13ce0e5d1fd22f2cfcb372986afb9b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 3KB
        • SHA256 bfc976f66a6ce601bf05d8756d3579f1fe2a94574bd0f551655890a8dbf3dfef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 4KB
        • SHA256 eb846a4911608e1fc628c4d54b8114c87582300f4c10f2956451d1ae94fd8c0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 2KB
        • SHA256 b395a74d1e62b3f817f16de27f29626892bf5d96253f14c5b463b5b87338589c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 2KB
        • SHA256 ad75ba01929d2a54ca467c1a8a25cb2249d9d53e770737f26247828a223ad96c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        resource.ini
        • Path C:\Users\Admin\AppData\Local\Temp\resource.ini
        • Size 237B
        • SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
        • MD5 SHA1 SHA512 TLSH
        Submit Download