Resubmissions
02/05/2026, 04:36
260502-e8n9bag17t02/05/2026, 04:33
260502-e623dsg16x302/05/2026, 04:06
260502-epekrscy7n3Analysis
- user interaction
yes - max time kernel
124s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 04:06
General
- Target void-fabric-1.1.8.jar
- Size 26KB
- Sample260502-epekrscy7n
- SHA256 d15ae0266fe3a52779f6125bd9621c09bd95fb38c2b0b2d6d09d3fec5a9dc32b
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\void-fabric-1.1.8.jar1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\StepRead.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
index.dat
CUSTOM.DIC
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.customDestinations-ms
memory/664-17-0x00007FF9039B0000-0x00007FF9039C0000-memory.dmp
memory/664-20-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/664-63-0x0000025336C50000-0x0000025336D6E000-memory.dmp
memory/664-15-0x00007FF9039B0000-0x00007FF9039C0000-memory.dmp
memory/664-18-0x00007FF9439C4000-0x00007FF9439C5000-memory.dmp
memory/664-22-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/664-24-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/664-26-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/664-25-0x00007FF9013A0000-0x00007FF9013B0000-memory.dmp
memory/664-23-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/664-21-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/664-16-0x00007FF9039B0000-0x00007FF9039C0000-memory.dmp
memory/664-19-0x00007FF9039B0000-0x00007FF9039C0000-memory.dmp
memory/664-27-0x00007FF9013A0000-0x00007FF9013B0000-memory.dmp
memory/664-14-0x00007FF9039B0000-0x00007FF9039C0000-memory.dmp
memory/664-62-0x00007FF943920000-0x00007FF943B29000-memory.dmp
memory/3896-75-0x0000025C6BFB0000-0x0000025C6C0CE000-memory.dmp
memory/3932-12-0x000001607C620000-0x000001607C628000-memory.dmp
memory/3932-13-0x0000016000000000-0x0000016000270000-memory.dmp
memory/3932-2-0x0000016000000000-0x0000016000270000-memory.dmp
memory/3932-11-0x000001607C640000-0x000001607C641000-memory.dmp