Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 14:26
Behavioral task
behavioral1
Sample
ECC 5.2/ECC.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
General
-
Target
ECC 5.2/ECC.exe
-
Size
119KB
-
MD5
122012c37511b5b009473afe6d6a3477
-
SHA1
0ac9e05c2917a1650dde20c99c3122438bc227bc
-
SHA256
813649a1af7bea223da8361c81e2e93a30870d2290c12a42e067f720849a1fd1
-
SHA512
5a95da63534c05232c9ec948f81ff1cdff106935ace38407e007cf25b9faa806d69acbc996b71cb0d50ea61309d24a35da6535b6878663fd42a8a7b495b02e74
-
SSDEEP
3072:2ff5cfbzoLsLOr/jy88x/HTxsC6Sk16m2DYB54rBHWKr8IuohkZ8:G5cjzoALO7jp8t9sPSk8RcnEHtr8EkZ8
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3968-0-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral2/memory/3968-1-0x0000000000400000-0x000000000043E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe 3968 ECC.exe