Analysis

  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    464s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/11/2026, 06:59

General

  • Target
    Project-Carl-Setup.exe
  • Size 59.8MB
  • Sample261110-hsf5jszzcx
  • SHA256 7dbf45486174313d9e898fa71c1ef447bb8e7eb508424dc110c79f41bc2470a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Project-Carl-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Project-Carl-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\is-PGVOQZRBRP.tmp\Project-Carl-Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PGVOQZRBRP.tmp\Project-Carl-Setup.tmp" /SL5="$80050,61123159,1049088,C:\Users\Admin\AppData\Local\Temp\Project-Carl-Setup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3372
      • C:\Program Files\Project Carl 0.9.61d\CARL.exe
        "C:\Program Files\Project Carl 0.9.61d\CARL.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\Program Files\Project Carl 0.9.61d\UnityCrashHandler64.exe
          "C:\Program Files\Project Carl 0.9.61d\UnityCrashHandler64.exe" --attach 3416 2579369431040
          4⤵
          • Executes dropped EXE
          PID:3032
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CARL.exe

        • Path C:\Program Files\Project Carl 0.9.61d\CARL.exe
        • Size 653KB
        • SHA256 1d4a6e35340c7beb187e91af02d4ee1b4f11e474df6ad480eb6ee1a6e94a5c47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CARLProtect.dll

        • Path C:\Program Files\Project Carl 0.9.61d\CARLProtect.dll
        • Size 196KB
        • SHA256 abbaef86f67787894baf55c96e2c7c792395b644e95c17362472562c7c95ab3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnityOpenXR.dll

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\Plugins\x86_64\UnityOpenXR.dll
        • Size 898KB
        • SHA256 8952aa1c01e290b51922103acc1f471ad140ab3f34fe56458ff8ac260630852e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        openxr_loader.dll

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\Plugins\x86_64\openxr_loader.dll
        • Size 2.3MB
        • SHA256 b91bc56bb8d18b062b443ee0bd76220ff06f449c3ff4882020682838bf282ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unity default resources

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\Resources\unity default resources
        • Size 5.6MB
        • SHA256 696b9afaee02b5d45978634f1450ef18423c19177933b997fd8ee364d70cdd61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unity_builtin_extra

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\Resources\unity_builtin_extra
        • Size 522KB
        • SHA256 2ee1bc4145c45f03cfe76f19c37254b0dd59dcc1148a4017aa2553af2bfc3a28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RuntimeInitializeOnLoads.json

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\RuntimeInitializeOnLoads.json
        • Size 4KB
        • SHA256 9fc89600bf2df6327b41224d9a2a950cf3d66e1bb9d8be5bb6337f4a252da7c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ScriptingAssemblies.json

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\ScriptingAssemblies.json
        • Size 3KB
        • SHA256 ec41ce8f613bea002cc8b0e076a39f57d73bf83d7aa05da02348c80531b72492
        • MD5 SHA1 SHA512 TLSH

        carl-access.enc

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\StreamingAssets\Locked\carl-access.enc
        • Size 1KB
        • SHA256 bcd0b31c1e30a125dbb5689041e8988e8aecd301d0c1267ae7e1e543a1109956
        • MD5 SHA1 SHA512 TLSH

        UnitySubsystemsManifest.json

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\UnitySubsystems\UnityOpenXR\UnitySubsystemsManifest.json
        • Size 250B
        • SHA256 2528d0caa5fb4c4ea91ed74fb88315fca934158314bcec29d12fbeaac8e7cfd6
        • MD5 SHA1 SHA512 TLSH

        app.info

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\app.info
        • Size 45B
        • SHA256 53a90d14ca8eb5c5b0405dd91372be87bcc710954e41342fffdd4c5588d16c1f
        • MD5 SHA1 SHA512

        boot.config

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\boot.config
        • Size 279B
        • SHA256 99ad7604ca5364a03454571773b096648f5d3d71a15f664e9470f1322903413b
        • MD5 SHA1 SHA512 TLSH

        globalgamemanagers

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\globalgamemanagers
        • Size 78KB
        • SHA256 a5721ee6f896cee4600d4347020d3dd9be7a6bb929ff42149b4bb350c3295ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        globalgamemanagers.assets

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\globalgamemanagers.assets
        • Size 145KB
        • SHA256 e086ab70aa5ad254c68378e8b684bd412a95c0ac58ca923d62f4b303a1014ece
        • MD5 SHA1 SHA512 SSDEEP TLSH

        globalgamemanagers.assets.resS

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\globalgamemanagers.assets.resS
        • Size 2.7MB
        • SHA256 39dd38fcd8dd95d41d6d55fe16a448d29fe2c31d9a162c825c24c6d99a893d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        global-metadata.dat

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\il2cpp_data\Metadata\global-metadata.dat
        • Size 5.9MB
        • SHA256 4c021f373231918c65c923614922ae9ccdd286ff4977687f887c10eae7591359
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mscorlib.dll-resources.dat

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\il2cpp_data\Resources\mscorlib.dll-resources.dat
        • Size 329KB
        • SHA256 c5baa176a5b72cd545266340e42102d393a5e43d38c95796bc828918bb95277f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        level0

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\level0
        • Size 1KB
        • SHA256 cb68f0d3be0ae210bb0f8cd064d583ce55cb0744837c9d71b58501ecce2fa031
        • MD5 SHA1 SHA512 TLSH

        official.manifest

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\official.manifest
        • Size 2KB
        • SHA256 c57fd35e6875ff338d77b02ee8ff4c2dcc30082342bd709e866615eb6a99474f
        • MD5 SHA1 SHA512 TLSH

        official.sig

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\official.sig
        • Size 512B
        • SHA256 27028d0ce11f6fe72dabf0575f8c3f7ec68f3017dcd27b896d40282f8f9b445b
        • MD5 SHA1 SHA512 TLSH

        resources.assets

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\resources.assets
        • Size 17.9MB
        • SHA256 879c254e3a5a79e1805d5475828818dc05d7b319c59f141c7267742aa675ec47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.assets.resS

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\resources.assets.resS
        • Size 36.3MB
        • SHA256 08cda004f4d9db1e7bb5d7b942fffcfc78aa4cd90c7b8b60bc0e092e4b1871ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.resource

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\resources.resource
        • Size 29.7MB
        • SHA256 ad9e5d0d806fbd2dcbd31b2a369ad283bf1bf125c7cae135ce559ee33a92c2d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sharedassets0.assets

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\sharedassets0.assets
        • Size 14KB
        • SHA256 f2fb5a5edc312d1836162efc1133c7c8a616f0b62be78b530c386b30c1658fa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sharedassets0.assets.resS

        • Path C:\Program Files\Project Carl 0.9.61d\CARL_Data\sharedassets0.assets.resS
        • Size 512KB
        • SHA256 393efe6399536384aa91bdfc4e64f244b4d3e1fbb6a4ff145c483ffee64ccb36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        D3D12Core.dll

        • Path C:\Program Files\Project Carl 0.9.61d\D3D12\D3D12Core.dll
        • Size 4.5MB
        • SHA256 70215cb4fa5a2990b7b5d79b63e5464f7f32537204d8701e9348acb307f422a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GameAssembly.dll

        • Path C:\Program Files\Project Carl 0.9.61d\GameAssembly.dll
        • Size 28.4MB
        • SHA256 1a00d432f7f079e2a8d928a8be5da3766bae62e5564806ba433a31b9a0d45ec9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnityCrashHandler64.exe

        • Path C:\Program Files\Project Carl 0.9.61d\UnityCrashHandler64.exe
        • Size 1.7MB
        • SHA256 fdcbc82ad349e6f6e312628dee4dbc31340ba52c2384698090f1e88e0dbf12a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnityPlayer.dll

        • Path C:\Program Files\Project Carl 0.9.61d\UnityPlayer.dll
        • Size 36.8MB
        • SHA256 fe326ef0b2fae89094000eaa7bb49a083e5a9385ff5c602a79e24a5a6d015782
        • MD5 SHA1 SHA512 SSDEEP TLSH

        baselib.dll

        • Path C:\Program Files\Project Carl 0.9.61d\baselib.dll
        • Size 224KB
        • SHA256 a2449487c8b1f3bf98bf02c358f51fe227af73ded97d6d6203eeeb283cb56fd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dstorage.dll

        • Path C:\Program Files\Project Carl 0.9.61d\dstorage.dll
        • Size 193KB
        • SHA256 f73c137ea20816fc7ff5d1740b1feee9940814d828d753de55124f618f59f434
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unins000.exe

        • Path C:\Program Files\Project Carl 0.9.61d\unins000.exe
        • Size 5.1MB
        • SHA256 b87a16ede2df9979ed3eb90e6119a9a45355d7defe490b6d066c06375b31459c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        statistics.txt

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt
        • Size 135B
        • SHA256 ad60829b0b9e0442bdfbcafbbffdf63bb9c23bab04c2df7ddeee9126d5bc1f21
        • MD5 SHA1 SHA512 TLSH

        statistics.txt.tmp

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt.tmp
        • Size 244B
        • SHA256 fb2110ea84097a1f0f891ee234a595625a1bd27b43c5875c5d73277745d56625
        • MD5 SHA1 SHA512 TLSH

        statistics.txt.tmp

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt.tmp
        • Size 244B
        • SHA256 f4fb96989f97f436b8d81946bb5f13bbf4c6c347e69e2789ab5a3bcd3391d432
        • MD5 SHA1 SHA512 TLSH

        statistics.txt.tmp

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt.tmp
        • Size 244B
        • SHA256 5a5c939fb39fac1ccaf904d6807141c272adc831443ffa2aa1b087a0b4e447e9
        • MD5 SHA1 SHA512 TLSH

        statistics.txt.tmp

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt.tmp
        • Size 244B
        • SHA256 736a35f0bd0e37f33da3a3f619f1477fc19130b5396c46b01c65e5731d558f2f
        • MD5 SHA1 SHA512 TLSH

        statistics.txt.tmp

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt.tmp
        • Size 244B
        • SHA256 098ec5975c68ba778f85a66796f885fcfdfbb0a3308d8a381e923d9a09f79de4
        • MD5 SHA1 SHA512 TLSH

        statistics.txt.tmp

        • Path C:\Users\Admin\AppData\LocalLow\Independent Prototype\Project CARL\statistics.txt.tmp
        • Size 243B
        • SHA256 3b2925044b586b251ffab450db0f6dce164295b61f0d407f712767248884638f
        • MD5 SHA1 SHA512 TLSH

        Project-Carl-Setup.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-PGVOQZRBRP.tmp\Project-Carl-Setup.tmp
        • Size 5.1MB
        • SHA256 d567d0f2cc4b1d3169e6a9337a9de581260f31eaaee03f4558d661849d11320f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3372-5-0x0000000001580000-0x0000000001581000-memory.dmp

        memory/3372-8-0x0000000001580000-0x0000000001581000-memory.dmp

        memory/3372-157-0x00000000002C0000-0x0000000000802000-memory.dmp

        memory/3372-124-0x00000000002C0000-0x0000000000802000-memory.dmp

        memory/3372-7-0x00000000002C0000-0x0000000000802000-memory.dmp

        memory/3416-197-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-215-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-167-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-159-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-151-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-160-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-161-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-152-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-187-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-188-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-190-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-189-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-192-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-191-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-194-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-193-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-196-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-195-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-198-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-162-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-200-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-199-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-202-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-201-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-204-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-203-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-163-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-164-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-214-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-213-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-216-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-172-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-218-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-217-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-220-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-219-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-221-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-222-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-224-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-223-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-226-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-225-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-228-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-227-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-230-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-229-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-165-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/3416-240-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-239-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-242-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-241-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-243-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-244-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-245-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-246-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-248-0x0000025A35140000-0x0000025A37052000-memory.dmp

        memory/3416-247-0x000002588E780000-0x0000025890D72000-memory.dmp

        memory/3416-153-0x0000025A37E30000-0x0000025A37E31000-memory.dmp

        memory/4876-0-0x0000000000A00000-0x0000000000B0F000-memory.dmp

        memory/4876-158-0x0000000000A00000-0x0000000000B0F000-memory.dmp

        memory/4876-6-0x0000000000A00000-0x0000000000B0F000-memory.dmp