Analysis
- max time kernel
148s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 12:09
General
- Target ECI DCA 1.5.17.56003.exe
- Size 4.9MB
- Sample261027-pblr2add95
- SHA256 3e9c780394d5f0485c74d80b4305f369e3f72ed3c73f2510f0a600fbf005f71e
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Modifies service settings 1 TTPs
Alters the configuration of existing services.
- Drops file in System32 directory 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 7 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 47 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ECI DCA 1.5.17.56003.exe"C:\Users\Admin\AppData\Local\Temp\ECI DCA 1.5.17.56003.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JAPEC.tmp\ECI DCA 1.5.17.56003.tmp"C:\Users\Admin\AppData\Local\Temp\is-JAPEC.tmp\ECI DCA 1.5.17.56003.tmp" /SL5="$400A6,4677349,428032,C:\Users\Admin\AppData\Local\Temp\ECI DCA 1.5.17.56003.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /im DCA.Edge.TrayIcon.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /t /im DCA.Edge.TrayIcon.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe"C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe" config --config "C:\ProgramData\ECI DCA\dca.config" --installer "C:\Users\Admin\AppData\Local\Temp\ECI DCA 1.5.17.56003.exe" --install-service3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create "DCAPulse" start= delayed-auto DisplayName= "ECI DCA" binPath= "\"C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe\" --config \"C:\ProgramData\ECI DCA\dca.config\""4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" failure "DCAPulse" reset= 180 actions= restart/5000/restart/30000/restart/1800004⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\ECI DCA\DCA.Edge.TrayIcon.exe"C:\Program Files (x86)\ECI DCA\DCA.Edge.TrayIcon.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe"C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe" start-service3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe"C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe" --config "C:\ProgramData\ECI DCA\dca.config"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\PROGRA~2\ECIDCA~1\DCA.Edge.TrayIcon.exeC:\PROGRA~2\ECIDCA~1\DCAEDG~2.EXE1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 11402⤵
- Program crash
-
-
C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe"C:\Program Files (x86)\ECI DCA\DCA.Edge.Console.exe" --config "C:\ProgramData\ECI DCA\dca.config"1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4488 -ip 44881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CommandLine.dll
DCA.Edge.Common.Transition.dll
DCA.Edge.Common.dll
DCA.Edge.Console.exe
DCA.Edge.Console.exe.config
DCA.Edge.Engine.dll
DCA.Edge.TrayIcon.exe
DCA.Fallback.DCA4.Common.dll
DCA.Fallback.DCA4.NSE.dll
DCA.Fallback.Onsite.Common.dll
DCA.Fallback.Onsite.Engine.dll
Hjson.dll
IPAddressRange.dll
NLog.dll
Newtonsoft.Json.dll
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_D4A3DED52475213BC81B347E270AF112
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_D4A3DED52475213BC81B347E270AF112
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
idp.dll
ECI DCA 1.5.17.56003.tmp
memory/760-304-0x0000000006ED0000-0x0000000006F78000-memory.dmp
memory/760-326-0x00000000077B0000-0x00000000077D2000-memory.dmp
memory/760-292-0x0000000006430000-0x0000000006464000-memory.dmp
memory/760-300-0x0000000006DE0000-0x0000000006E14000-memory.dmp
memory/760-288-0x00000000063D0000-0x00000000063EA000-memory.dmp
memory/760-262-0x0000000000FB0000-0x0000000001012000-memory.dmp
memory/760-308-0x0000000006F80000-0x0000000006FE8000-memory.dmp
memory/760-311-0x0000000006E20000-0x0000000006EA2000-memory.dmp
memory/760-266-0x0000000005BE0000-0x0000000005CBC000-memory.dmp
memory/760-283-0x00000000067F0000-0x00000000068A2000-memory.dmp
memory/760-287-0x0000000005BC0000-0x0000000005BCE000-memory.dmp
memory/760-315-0x0000000006EB0000-0x0000000006EBA000-memory.dmp
memory/760-319-0x0000000007050000-0x0000000007086000-memory.dmp
memory/760-270-0x0000000005EB0000-0x0000000005FA2000-memory.dmp
memory/760-323-0x0000000007090000-0x00000000070A2000-memory.dmp
memory/760-324-0x0000000007020000-0x0000000007028000-memory.dmp
memory/760-325-0x00000000072F0000-0x0000000007312000-memory.dmp
memory/760-296-0x0000000006410000-0x0000000006420000-memory.dmp
memory/760-327-0x00000000077E0000-0x0000000007B3B000-memory.dmp
memory/1292-369-0x0000000005FE0000-0x000000000607C000-memory.dmp
memory/1296-351-0x0000000000390000-0x000000000048A000-memory.dmp
memory/1296-354-0x0000000005560000-0x0000000005B1A000-memory.dmp
memory/1296-359-0x0000000005280000-0x0000000005312000-memory.dmp
memory/1296-368-0x00000000053A0000-0x00000000053AA000-memory.dmp
memory/4208-12-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4208-0-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4208-466-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4560-13-0x0000000000400000-0x0000000000578000-memory.dmp
memory/4560-6-0x0000000002350000-0x0000000002351000-memory.dmp
memory/4560-14-0x0000000002350000-0x0000000002351000-memory.dmp
memory/4560-310-0x0000000000400000-0x0000000000578000-memory.dmp
memory/4560-16-0x0000000000400000-0x0000000000578000-memory.dmp
memory/4560-465-0x0000000000400000-0x0000000000578000-memory.dmp
memory/4560-404-0x0000000000400000-0x0000000000578000-memory.dmp
memory/5748-389-0x0000000006720000-0x0000000006734000-memory.dmp
memory/5748-427-0x00000000082A0000-0x00000000082AE000-memory.dmp
memory/5748-386-0x0000000005C60000-0x0000000005C68000-memory.dmp
memory/5748-387-0x0000000005EC0000-0x0000000005EE8000-memory.dmp
memory/5748-388-0x00000000067D0000-0x00000000068B2000-memory.dmp
memory/5748-384-0x0000000005DA0000-0x0000000005DBC000-memory.dmp
memory/5748-390-0x0000000006750000-0x0000000006758000-memory.dmp
memory/5748-391-0x0000000006770000-0x000000000677E000-memory.dmp
memory/5748-392-0x0000000006780000-0x000000000678A000-memory.dmp
memory/5748-393-0x0000000006930000-0x0000000006996000-memory.dmp
memory/5748-395-0x0000000007280000-0x0000000007898000-memory.dmp
memory/5748-396-0x0000000006D70000-0x00000000070CB000-memory.dmp
memory/5748-399-0x0000000007A00000-0x0000000007A08000-memory.dmp
memory/5748-400-0x0000000007CA0000-0x0000000007CB0000-memory.dmp
memory/5748-401-0x0000000007CD0000-0x0000000007CE2000-memory.dmp
memory/5748-402-0x0000000007D40000-0x0000000007D7C000-memory.dmp
memory/5748-381-0x0000000005C50000-0x0000000005C5A000-memory.dmp
memory/5748-407-0x0000000007EA0000-0x0000000007EAA000-memory.dmp
memory/5748-408-0x0000000007EB0000-0x0000000007EBC000-memory.dmp
memory/5748-410-0x0000000007F20000-0x0000000007F40000-memory.dmp
memory/5748-411-0x0000000008080000-0x00000000081B2000-memory.dmp
memory/5748-412-0x0000000007F50000-0x0000000007F5C000-memory.dmp
memory/5748-413-0x0000000007F80000-0x0000000007F8C000-memory.dmp
memory/5748-414-0x0000000007FC0000-0x0000000007FE8000-memory.dmp
memory/5748-415-0x00000000081C0000-0x0000000008204000-memory.dmp
memory/5748-416-0x0000000007FF0000-0x0000000008008000-memory.dmp
memory/5748-417-0x0000000008210000-0x000000000825E000-memory.dmp
memory/5748-418-0x0000000007FB0000-0x0000000007FBA000-memory.dmp
memory/5748-419-0x0000000008020000-0x000000000802C000-memory.dmp
memory/5748-420-0x0000000008030000-0x0000000008038000-memory.dmp
memory/5748-421-0x0000000008040000-0x000000000804E000-memory.dmp
memory/5748-422-0x0000000008260000-0x000000000827C000-memory.dmp
memory/5748-423-0x00000000082E0000-0x000000000833A000-memory.dmp
memory/5748-424-0x0000000008340000-0x0000000008376000-memory.dmp
memory/5748-425-0x0000000008280000-0x0000000008296000-memory.dmp
memory/5748-385-0x0000000005E90000-0x0000000005EB8000-memory.dmp
memory/5748-426-0x0000000008060000-0x000000000806C000-memory.dmp
memory/5748-428-0x00000000082B0000-0x00000000082BA000-memory.dmp
memory/5748-429-0x00000000083C0000-0x00000000083F6000-memory.dmp
memory/5748-430-0x0000000008380000-0x000000000839C000-memory.dmp
memory/5748-431-0x00000000082D0000-0x00000000082DE000-memory.dmp
memory/5748-432-0x00000000083B0000-0x00000000083B8000-memory.dmp
memory/5748-433-0x0000000008410000-0x000000000841A000-memory.dmp
memory/5748-434-0x0000000008420000-0x000000000842A000-memory.dmp
memory/5748-435-0x0000000008430000-0x000000000843A000-memory.dmp
memory/5748-436-0x0000000008470000-0x000000000849E000-memory.dmp
memory/5748-437-0x0000000008450000-0x0000000008458000-memory.dmp
memory/5748-438-0x0000000008460000-0x0000000008470000-memory.dmp
memory/5748-439-0x00000000084D0000-0x00000000084EA000-memory.dmp
memory/5748-440-0x0000000008530000-0x000000000856A000-memory.dmp
memory/5748-441-0x0000000008570000-0x0000000008598000-memory.dmp
memory/5748-442-0x00000000085A0000-0x00000000085D2000-memory.dmp
memory/5748-443-0x0000000008510000-0x000000000852E000-memory.dmp
memory/5748-444-0x00000000084F0000-0x00000000084FA000-memory.dmp
memory/5748-446-0x00000000085E0000-0x00000000085EC000-memory.dmp
memory/5748-447-0x0000000008600000-0x000000000860C000-memory.dmp
memory/5748-449-0x0000000008620000-0x0000000008628000-memory.dmp
memory/5748-450-0x0000000008650000-0x0000000008666000-memory.dmp
memory/5748-451-0x0000000008630000-0x0000000008638000-memory.dmp
memory/5748-448-0x0000000008610000-0x0000000008618000-memory.dmp
memory/5748-452-0x0000000008640000-0x0000000008648000-memory.dmp
memory/5748-445-0x0000000008500000-0x0000000008508000-memory.dmp
memory/5748-453-0x0000000008670000-0x000000000867A000-memory.dmp
memory/5748-454-0x0000000008680000-0x0000000008688000-memory.dmp
memory/5748-455-0x0000000008750000-0x000000000880E000-memory.dmp
memory/5748-456-0x00000000086B0000-0x00000000086C6000-memory.dmp
memory/5748-457-0x00000000088B0000-0x0000000008950000-memory.dmp
memory/5748-458-0x0000000005620000-0x000000000563A000-memory.dmp
memory/5748-380-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/5748-379-0x0000000005DE0000-0x0000000005E56000-memory.dmp