Analysis
- max time kernel
150s - max time network
114s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
11/05/2026, 01:59
General
- Target dControl.exe
- Size 447KB
- Sample260511-cep8eads3j
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Malware Config
Signatures
- AutoIT Executable 34 IoCs
AutoIT scripts compiled to PE executables.
- UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 16 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dControl.exeC:\Users\Admin\AppData\Local\Temp\dControl.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dControl.exe"C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3308|3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dControl.ini
5a0z6x4t.tmp
5z7g8k8b.tmp
autEBA8.tmp
autEBA9.tmp
autEBAA.tmp
memory/252-299-0x0000000002700000-0x000000000289A000-memory.dmp
memory/428-184-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/428-164-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/804-207-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/896-365-0x0000000002EE0000-0x000000000307A000-memory.dmp
memory/916-367-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/944-162-0x000001F3B14A0000-0x000001F3B163A000-memory.dmp
memory/1068-321-0x0000000003180000-0x000000000331A000-memory.dmp
memory/1112-230-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1156-319-0x0000000002CF0000-0x0000000002E8A000-memory.dmp
memory/1548-322-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1632-182-0x0000000002260000-0x00000000023FA000-memory.dmp
memory/1692-386-0x00000000025A0000-0x000000000273A000-memory.dmp
memory/1704-388-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1724-301-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1724-282-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1924-412-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1924-156-0x000001EE94860000-0x000001EE949FA000-memory.dmp
memory/1924-391-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2220-277-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2228-250-0x000001759D610000-0x000001759D7AA000-memory.dmp
memory/2276-252-0x0000000002E00000-0x0000000002F9A000-memory.dmp
memory/2360-366-0x0000000002580000-0x000000000271A000-memory.dmp
memory/2372-181-0x0000000002520000-0x00000000026BA000-memory.dmp
memory/2376-112-0x0000000003400000-0x000000000359A000-memory.dmp
memory/2464-228-0x00000000027F0000-0x000000000298A000-memory.dmp
memory/2480-343-0x0000000002680000-0x000000000281A000-memory.dmp
memory/2500-254-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2520-87-0x00000000028D0000-0x0000000002A6A000-memory.dmp
memory/2692-300-0x0000000002EE0000-0x000000000307A000-memory.dmp
memory/2716-19-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2716-1-0x00000000004CC000-0x00000000004CD000-memory.dmp
memory/2716-0-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2948-136-0x0000000002E60000-0x0000000002FFA000-memory.dmp
memory/3048-275-0x0000000002C40000-0x0000000002DDA000-memory.dmp
memory/3068-387-0x0000000002580000-0x000000000271A000-memory.dmp
memory/3096-227-0x000002DE3FE10000-0x000002DE3FFAA000-memory.dmp
memory/3140-251-0x0000000002C50000-0x0000000002DEA000-memory.dmp
memory/3260-341-0x0000022FEE690000-0x0000022FEE82A000-memory.dmp
memory/3604-345-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3712-436-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3864-205-0x00000000029D0000-0x0000000002B6A000-memory.dmp
memory/4188-138-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4352-90-0x000001C187C30000-0x000001C187DCA000-memory.dmp
memory/4432-135-0x0000000002310000-0x00000000024AA000-memory.dmp
memory/4508-94-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4508-114-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4516-111-0x0000000002EF0000-0x000000000308A000-memory.dmp
memory/4572-320-0x000002A968FF0000-0x000002A96918A000-memory.dmp
memory/4760-408-0x000001F868880000-0x000001F868A1A000-memory.dmp
memory/4896-410-0x00000000023C0000-0x000000000255A000-memory.dmp
memory/4920-115-0x000002009BFD0000-0x000002009C16A000-memory.dmp
memory/5064-89-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5064-69-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5068-86-0x0000000002AF0000-0x0000000002C8A000-memory.dmp
memory/5108-364-0x000001AB22CF0000-0x000001AB22E8A000-memory.dmp
memory/5188-186-0x0000027E17670000-0x0000027E1780A000-memory.dmp
memory/5296-157-0x00000000022C0000-0x000000000245A000-memory.dmp
memory/5372-276-0x0000000002B60000-0x0000000002CFA000-memory.dmp
memory/5396-204-0x0000000002360000-0x00000000024FA000-memory.dmp
memory/5568-229-0x0000000003070000-0x000000000320A000-memory.dmp
memory/5712-160-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5732-255-0x0000020B08280000-0x0000020B0841A000-memory.dmp
memory/5760-342-0x0000000002590000-0x000000000272A000-memory.dmp
memory/5788-91-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-389-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-258-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-185-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-66-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-323-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-208-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-279-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-116-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-347-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-415-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-67-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-161-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5788-231-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5860-385-0x00000199690D0000-0x000001996926A000-memory.dmp
memory/5920-278-0x0000019B7BD10000-0x0000019B7BEAA000-memory.dmp
memory/5924-158-0x0000000002930000-0x0000000002ACA000-memory.dmp
memory/6096-409-0x0000000002B10000-0x0000000002CAA000-memory.dmp