Technical Information
Modifies file system
Creates the following files
- C:\ercom\e2desktop\<File name>.exe
- nul
- C:\ercom\e2desktop\ercom online.lnk
- C:\ercom\e2desktop\ercom_online.ini
Moves the following files
- from C:\ercom\e2desktop\ercom online.lnk to %HOMEPATH%\desktop\ercom online.lnk
Deletes itself.
Network activity
Connects to
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- 'C:\ercom\e2desktop\<File name>.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 > nul & del "<Full path to file>" & start "" "C:\Ercom\E2Desktop\<File name>.exe"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 > nul & del "<Full path to file>" & start "" "C:\Ercom\E2Desktop\<File name>.exe"' (with hidden window)
