Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 04:49
General
- Target DualSenseX-Setup.exe
- Size 15.0MB
- Sample261027-ffn9aaaw4x
- SHA256 65c013bd155d9243b107d591ea7a1e7074fa117c99e11e8bba70b75fdc1faaca
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 27 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DualSenseX-Setup.exe"C:\Users\Admin\AppData\Local\Temp\DualSenseX-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\DualSenseX\app-1.4.9\DualSenseX.exe"C:\Users\Admin\AppData\Local\DualSenseX\app-1.4.9\DualSenseX.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 23964⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2012 -ip 20121⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DualSenseX.exe
DualSenseX.exe
DualSenseX.exe.config
Microsoft.AppCenter.Analytics.dll
Microsoft.AppCenter.Crashes.dll
Microsoft.AppCenter.dll
ModernWpf.Controls.dll
ModernWpf.dll
NAudio.Wasapi.dll
Newtonsoft.Json.dll
SQLitePCLRaw.batteries_v2.dll
SQLitePCLRaw.core.dll
SQLitePCLRaw.nativelibrary.dll
SQLitePCLRaw.provider.dynamic_cdecl.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
e_sqlite3.dll
DualSenseX-1.4.9-full.nupkg
RELEASES
Update.exe
setupIcon.ico
memory/2012-252-0x0000000005910000-0x0000000005918000-memory.dmp
memory/2012-295-0x0000000007070000-0x0000000007078000-memory.dmp
memory/2012-315-0x00000000080F0000-0x00000000081A2000-memory.dmp
memory/2012-311-0x0000000008350000-0x00000000086AB000-memory.dmp
memory/2012-310-0x0000000007DB0000-0x0000000007DD2000-memory.dmp
memory/2012-236-0x0000000073A52000-0x0000000073A53000-memory.dmp
memory/2012-249-0x0000000005940000-0x0000000005A26000-memory.dmp
memory/2012-309-0x0000000007D50000-0x0000000007D80000-memory.dmp
memory/2012-251-0x0000000005D30000-0x0000000005D56000-memory.dmp
memory/2012-253-0x0000000005920000-0x000000000592A000-memory.dmp
memory/2012-305-0x00000000081C0000-0x0000000008348000-memory.dmp
memory/2012-257-0x0000000006B20000-0x0000000006B48000-memory.dmp
memory/2012-304-0x0000000007CB0000-0x0000000007D42000-memory.dmp
memory/2012-303-0x0000000007BA0000-0x0000000007C06000-memory.dmp
memory/2012-269-0x0000000006D70000-0x0000000006E20000-memory.dmp
memory/2012-270-0x00000000073E0000-0x000000000799A000-memory.dmp
memory/2012-261-0x0000000006B00000-0x0000000006B0A000-memory.dmp
memory/2012-294-0x0000000007040000-0x0000000007048000-memory.dmp
memory/2012-265-0x0000000006B10000-0x0000000006B20000-memory.dmp
memory/2012-301-0x0000000007110000-0x0000000007118000-memory.dmp
memory/2012-277-0x0000000006FC0000-0x0000000006FC8000-memory.dmp
memory/2012-238-0x00000000003D0000-0x0000000000E3C000-memory.dmp
memory/2012-278-0x0000000006FF0000-0x000000000700A000-memory.dmp
memory/2012-290-0x00000000070A0000-0x00000000070C6000-memory.dmp
memory/2012-282-0x0000000007010000-0x0000000007022000-memory.dmp
memory/2012-286-0x0000000007050000-0x0000000007064000-memory.dmp
memory/3040-11-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-217-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-15-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-50-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-84-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-12-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-116-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-197-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-47-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-16-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-210-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-218-0x000000001B280000-0x000000001B2A0000-memory.dmp
memory/3040-10-0x00000000004D0000-0x00000000006A6000-memory.dmp
memory/3040-250-0x00007FFA3ABF0000-0x00007FFA3B594000-memory.dmp
memory/3040-244-0x000000001F390000-0x000000001F3CE000-memory.dmp
memory/3040-245-0x000000001F360000-0x000000001F36E000-memory.dmp
memory/3040-9-0x00007FFA3AD7F000-0x00007FFA3AD80000-memory.dmp
memory/3040-243-0x000000001EA10000-0x000000001EA18000-memory.dmp