Overview

overview

7

Static

static

3

DahliaControlV2.0.exe

windows10-2004-x64

7

DahliaControlV2.0.exe

windows11-ltsc_2024-x64

7

DahliaControlV3.exe

windows10-2004-x64

7

DahliaControlV3.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DahliaControlV3.exe
  • Size 168.6MB
  • Sample260928-rt99fswene
  • SHA256 bb726349d996c1b8e056fbb0abc8b2641324cc2e910708dc33a49b3e45f58eec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe
    "C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"
    1⤵
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "$csc = (Get-ChildItem -Path $env:windir\\Microsoft.NET\\Framework64 -Filter 'csc.exe' -Recurse | Sort-Object LastWriteTime -Descending | Select-Object -First 1).FullName; & $csc /nologo /out:'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.exe' /target:winexe /reference:System.Windows.Forms.dll 'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs'""
      2⤵
      • Executes a command shell one-liner
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command "$csc = (Get-ChildItem -Path $env:windir\\Microsoft.NET\\Framework64 -Filter 'csc.exe' -Recurse | Sort-Object LastWriteTime -Descending | Select-Object -First 1).FullName; & $csc /nologo /out:'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.exe' /target:winexe /reference:System.Windows.Forms.dll 'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs'"
        3⤵
        • Enumerates connected drives
        • Command and Scripting Interpreter: PowerShell
        • System Time Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /out:C:\Users\Admin\AppData\Local\Temp\DahliaBridge.exe /target:winexe /reference:System.Windows.Forms.dll C:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2448
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CBD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEB5FF12C33354F3AB73FB17A20B14A65.TMP"
            5⤵
              PID:1768
      • C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe
        "C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,5078854676967403829,11648984150392605220,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        2⤵
          PID:4028
        • C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe
          "C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --mojo-platform-channel-handle=2560 --field-trial-handle=1708,i,5078854676967403829,11648984150392605220,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
          2⤵
          • Reads the TCP/IP host and domain name from the registry
          PID:116
        • C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe
          "C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2608 --field-trial-handle=1708,i,5078854676967403829,11648984150392605220,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          PID:240
        • C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe
          "C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3644 --field-trial-handle=1708,i,5078854676967403829,11648984150392605220,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
          2⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          PID:3708

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RES7CBD.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES7CBD.tmp
            • Size 1KB
            • SHA256 ac523cb92514c2d6ced3a63bbe572e498113bd2ed50d7c4cc96cee8d915b9c89
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_jiajyvyt.lih.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jiajyvyt.lih.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\client-chat-app\Network\Network Persistent State
            • Size 855B
            • SHA256 8ddccb64dadc3be33275119f9e6c04cf8c524618d1e48d2b42a76d747dea5505
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe5991a7.TMP
            • Path C:\Users\Admin\AppData\Roaming\client-chat-app\Network\Network Persistent State~RFe5991a7.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSCEB5FF12C33354F3AB73FB17A20B14A65.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\CSCEB5FF12C33354F3AB73FB17A20B14A65.TMP
            • Size 1KB
            • SHA256 8eb95f42e4da5d4b2551ad2bc09415bd358fd3886f2660edbfff6c1ca33a2cbd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DahliaBridge.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs
            • Size 3KB
            • SHA256 208d840499311026f326c05aadb9a30af8b2d7dc566ecf54a02b2921b46c096f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/3508-2-0x000002022E510000-0x000002022E532000-memory.dmp
            Download

            memory/3708-95-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-94-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-93-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-105-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-104-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-103-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-102-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-101-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-100-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download

            memory/3708-99-0x00000216261D0000-0x00000216261D1000-memory.dmp
            Download