File name:

dControl.exe

Full analysis: https://app.any.run/tasks/fa063814-61dc-4107-8c40-22745a3ecd77
Verdict: Malicious activity
Analysis date: June 04, 2025, 19:27:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
defendercontrol
tool
upx
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

58008524A6473BDF86C1040A9A9E39C3

SHA1:

CB704D2E8DF80FD3500A5B817966DC262D80DDB8

SHA256:

1EF6C1A4DFDC39B63BFE650CA81AB89510DE6C0D3D7C608AC5BE80033E559326

SSDEEP:

6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 1176)
      • dControl.exe (PID: 1228)
      • dControl.exe (PID: 7888)
      • dControl.exe (PID: 7768)

    • Creates or modifies Windows services

      • dControl.exe (PID: 7888)

    • Disables Windows Defender

      • dControl.exe (PID: 7888)

    • Changes image file execution options

      • dControl.exe (PID: 7888)

  • SUSPICIOUS

    • Application launched itself

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 1228)
      • dControl.exe (PID: 7888)

    • Creates or modifies Windows services

      • dControl.exe (PID: 7888)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 896)

    • There is functionality for taking screenshot (YARA)

      • dControl.exe (PID: 7888)

  • INFO

    • The sample compiled with english language support

      • dControl.exe (PID: 5956)

    • Checks supported languages

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 1228)
      • dControl.exe (PID: 7888)
      • dControl.exe (PID: 7768)
      • MpCmdRun.exe (PID: 7264)

    • Create files in a temporary directory

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 7888)

    • Reads mouse settings

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 1228)
      • dControl.exe (PID: 7888)
      • dControl.exe (PID: 7768)

    • Reads the computer name

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 1228)
      • dControl.exe (PID: 7888)
      • dControl.exe (PID: 7768)
      • MpCmdRun.exe (PID: 7264)

    • DEFENDERCONTROL has been detected

      • dControl.exe (PID: 5956)
      • dControl.exe (PID: 1228)
      • dControl.exe (PID: 7888)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 8124)

    • The process uses AutoIt

      • dControl.exe (PID: 7888)

    • UPX packer has been detected

      • dControl.exe (PID: 7888)

    • Reads the software policy settings

      • slui.exe (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:12:23 10:59:31+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 270336
InitializedDataSize: 61440
UninitializedDataSize: 503808
EntryPoint: 0xbd650
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
FileVersion: 2.1.0.0
Comments: dControl v2.1
FileDescription: dControl v2.1
LegalCopyright: Copyright © 2015-2022 www.sordum.org All Rights Reserved.
CompanyName: www.sordum.org
ProductVersion: 2.1.0.0
OriginalFileName: dControl.exe
Coder: By BlueLife
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
13
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dcontrol.exe sppextcomobj.exe no specs slui.exe dcontrol.exe dcontrol.exe explorer.exe no specs dcontrol.exe no specs mpcmdrun.exe no specs conhost.exe no specs explorer.exe no specs securityhealthsystray.exe no specs slui.exe no specs dcontrol.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896"C:\WINDOWS\Explorer.exe" C:\WINDOWS\System32\SecurityHealthSystray.exeC:\Windows\explorer.exe—dControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
1176"C:\Users\admin\AppData\Local\Temp\dControl.exe" C:\Users\admin\AppData\Local\Temp\dControl.exe—explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
MEDIUM
Description:
dControl v2.1
Exit code:
3221226540
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1228C:\Users\admin\AppData\Local\Temp\dControl.exeC:\Users\admin\AppData\Local\Temp\dControl.exe
dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1696"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5956"C:\Users\admin\AppData\Local\Temp\dControl.exe" C:\Users\admin\AppData\Local\Temp\dControl.exe
explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
HIGH
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—MpCmdRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7048C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7264"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableC:\Program Files\Windows Defender\MpCmdRun.exe—dControl.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2147942405
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
7768"C:\Users\admin\AppData\Local\Temp\dControl.exe" /EXP |5492|C:\Users\admin\AppData\Local\Temp\dControl.exe—dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7888"C:\Users\admin\AppData\Local\Temp\dControl.exe" /TI C:\Users\admin\AppData\Local\Temp\dControl.exe
dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 757
Read events
1 712
Write events
32
Delete events
13

Modification events

(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdFilter
Operation:writeName:Start
Value:
0
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv
Operation:writeName:Start
Value:
3
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc
Operation:writeName:Start
Value:
3
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager
Operation:delete keyName:(default)
Value:
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:delete keyName:(default)
Value:
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet
Operation:delete keyName:(default)
Value:
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:delete keyName:(default)
Value:
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
Operation:delete valueName:DisableAntiSpyware
Value:
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
Operation:delete valueName:DisableAntiVirus
Value:
(PID) Process:(7888) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
Operation:delete valueName:DisableRealtimeMonitoring
Value:
Executable files
0
Suspicious files
13
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5956dControl.exeC:\Users\admin\AppData\Local\Temp\autF606.tmpbinary
MD5:EFE44D9F6E4426A05E39F99AD407D3E7
SHA256:5EA3B26C6B1B71EDAEF17CE365D50BE963AE9F4CB79B39EC723FE6E9E4054366
1228dControl.exeC:\Windows\Temp\autF7AB.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
5956dControl.exeC:\Users\admin\AppData\Local\Temp\autF617.tmpbinary
MD5:ECFFD3E81C5F2E3C62BCDC122442B5F2
SHA256:9874AB363B07DCC7E9CD6022A380A64102C1814343642295239A9F120CB941C5
1228dControl.exeC:\Windows\Temp\autF7BD.tmpbinary
MD5:ECFFD3E81C5F2E3C62BCDC122442B5F2
SHA256:9874AB363B07DCC7E9CD6022A380A64102C1814343642295239A9F120CB941C5
5956dControl.exeC:\Users\admin\AppData\Local\Temp\autF5F6.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
7888dControl.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:B6624E6BBE442A34AD53B000128297E4
SHA256:70BBF229F9BD344BAA8B762C3BC6AD3959D9F9C95A7963ECADA9C88C022EFEEF
7888dControl.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:617078BCAAA2FF95E4438D83A49CE878
SHA256:42EC7933F10ABA61202B3FC7D3C02D47CFD0C953A8F2CB0E39DF3069697F99EF
7264MpCmdRun.exeC:\Windows\Temp\MpCmdRun.logtext
MD5:53F3F796EDD78B9B33D2D494BB884CA8
SHA256:93CB021D2012B3FA0EB548DA94524226F27A2D152201C766FE7A620B84226290
7768dControl.exeC:\Windows\Temp\aut2015.tmpbinary
MD5:ECFFD3E81C5F2E3C62BCDC122442B5F2
SHA256:9874AB363B07DCC7E9CD6022A380A64102C1814343642295239A9F120CB941C5
7768dControl.exeC:\Windows\Temp\aut2003.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5408
svchost.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5408
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5408
svchost.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5408
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7252
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5408
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2196
svchost.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 184.25.50.8
  • 184.25.50.10
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 2.23.246.101
whitelisted
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.131
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.71
  • 40.126.31.129
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dControl.exe