OXLOADER dui70.dll module-stomp: aBsvwbdas.exe drops .ocx to %TEMP% for CASTLESTEALER

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects the execution of OXLOADER (aBsvwbdas.exe) which drops a maliciously crafted .ocx file (a copy of dui70.dll) into the %TEMP% directory. This behavior is indicative of module stomping to facilitate the in-memory execution of CASTLESTEALER via techniques like DonutLoader and RunPE.