Overview

overview

8

Static

static

1

voicewave_...32.exe

windows10-2004-x64

8

voicewave_...32.exe

windows11-ltsc_2024-x64

4

$TEMP/evw_...er.exe

windows10-2004-x64

3

$TEMP/evw_...er.exe

windows11-ltsc_2024-x64

3

$TEMP/evw_...ap.dll

windows10-2004-x64

3

$TEMP/evw_...ap.dll

windows11-ltsc_2024-x64

3

$TEMP/evw_...xe.exe

windows10-2004-x64

3

$TEMP/evw_...xe.exe

windows11-ltsc_2024-x64

3

$TEMP/evw_...up.exe

windows10-2004-x64

3

$TEMP/evw_...up.exe

windows11-ltsc_2024-x64

3

$TEMP/evw_...rl.dll

windows10-2004-x64

3

$TEMP/evw_...rl.dll

windows11-ltsc_2024-x64

3

$TEMP/evw_...40.dll

windows10-2004-x64

3

$TEMP/evw_...40.dll

windows11-ltsc_2024-x64

3

$TEMP/evw_...b1.dll

windows10-2004-x64

3

$TEMP/evw_...b1.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMP/evw_setup/1.0.0/46free/EDownloader.exe
  • Size 3.4MB
  • Sample260929-2eet4swdkc
  • SHA256 09fc252661481ea65e23c90babdb7801be6b77dc5db3095cf726372d0d80ff0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\EDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\EDownloader.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /Uid "S-1-5-21-2304238888-3968896904-642854331-1000"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3800
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"\",\"Timezone\":\"GMT-00:00\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
        C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5688
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:260
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1yqyi2epbbxvx.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3500
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d1kp3984eicvmo.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"2\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2724
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"https://d26eyml8eh90ed.cloudfront.net/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"1\",\"Errorinfo\":\"4\",\"Result\":\"Failed\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4764
    • C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
      /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"0.00B\",\"Elapsedtime\":\"11\",\"Errorinfo\":\"1004\",\"Result\":\"result_fail\"}"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      PID:5444

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AliyunConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
        • Size 1KB
        • SHA256 0bb60cdb600c3ebc0cc9238b6878ad26f099b52ca3d76d5156e051a1788ad1c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 554B
        • SHA256 45bb0dce771e7be00386d49ebae14e3a1f720d9a6f58138af14fa80cae50f7cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 720B
        • SHA256 b9fc6c5290d804e329604ba2bc9bd5e62315123ccc737fb3bd2c7d2ff0dac74f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 720B
        • SHA256 935c705ad355804be995a7abd83e9502d8fc07992721020578991445cda58d49
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 1KB
        • SHA256 96b0a3e490b11c39ff3cd958723c62e262b8a7bbb0ac4527e56f75b6d6a11310
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 618B
        • SHA256 f3e8fde2a082173a5ff727276c072af343123d9355f34b52e7091a12f66132cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 88B
        • SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DataFile.ini
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\aliyun\DataFile.ini
        • Size 698B
        • SHA256 82b4577ea43cee1cadb84e3ab0f1216ef2d18487743735f69420e8a34f0d40ab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 3KB
        • SHA256 50c846a04c8a687243ce8e71952efc33d8e561ca2cd65377d6166ec0e6a56dc2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 3KB
        • SHA256 6a4a991bc14864bd120d0b6eea758f8724e4a32727ccf7bc0377b09ad538049d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 4KB
        • SHA256 554b67c64b9500ccc34235df94d72449c9a578d7dea639d96f2997bd7d38b661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 2KB
        • SHA256 b68d41ad1edbbcfca090c2bee7b2ea44bd367fd8a71a7c2d59d99c736628b23e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.log
        • Path C:\Users\Admin\AppData\Local\Temp\$TEMP\evw_setup\1.0.0\46free\installer.log
        • Size 2KB
        • SHA256 4771a18019f1b4a7bcbcb79678093aa3503eecae9fc4143de215e02d01a4e28e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        resource.ini
        • Path C:\Users\Admin\AppData\Local\Temp\resource.ini
        • Size 237B
        • SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
        • MD5 SHA1 SHA512 TLSH
        Submit Download