Analysis
- max time kernel
153s - max time network
165s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 14:30
General
- Target DahliaControlV3.exe
- Size 168.6MB
- Sample260928-rt99fswene
- SHA256 bb726349d996c1b8e056fbb0abc8b2641324cc2e910708dc33a49b3e45f58eec
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"1⤵
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "$csc = (Get-ChildItem -Path $env:windir\\Microsoft.NET\\Framework64 -Filter 'csc.exe' -Recurse | Sort-Object LastWriteTime -Descending | Select-Object -First 1).FullName; & $csc /nologo /out:'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.exe' /target:winexe /reference:System.Windows.Forms.dll 'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs'""2⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -Command "$csc = (Get-ChildItem -Path $env:windir\\Microsoft.NET\\Framework64 -Filter 'csc.exe' -Recurse | Sort-Object LastWriteTime -Descending | Select-Object -First 1).FullName; & $csc /nologo /out:'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.exe' /target:winexe /reference:System.Windows.Forms.dll 'C:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs'"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /out:C:\Users\Admin\AppData\Local\Temp\DahliaBridge.exe /target:winexe /reference:System.Windows.Forms.dll C:\Users\Admin\AppData\Local\Temp\DahliaBridge.cs4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB721.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC22F8670CBA1D4034B61013A2F701A72.TMP"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1684 --field-trial-handle=1688,i,9083254781520498415,7817960588030767494,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --mojo-platform-channel-handle=2376 --field-trial-handle=1688,i,9083254781520498415,7817960588030767494,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2668 --field-trial-handle=1688,i,9083254781520498415,7817960588030767494,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe"C:\Users\Admin\AppData\Local\Temp\DahliaControlV3.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\client-chat-app" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3380 --field-trial-handle=1688,i,9083254781520498415,7817960588030767494,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
RESB721.tmp
default.exc
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe5acd06.TMP
CSC22F8670CBA1D4034B61013A2F701A72.TMP
DahliaBridge.cs
memory/4460-2-0x0000029256A40000-0x0000029256A62000-memory.dmp
memory/4700-102-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-100-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-109-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-111-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-110-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-108-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-107-0x00000196C88D0000-0x00000196C88D1000-memory.dmp
memory/4700-106-0x00000196C88D0000-0x00000196C88D1000-memory.dmp