Overview

overview

10

Static

static

3

installer.exe

windows10-2004-x64

10

installer.exe

windows11-21h2-x64

7

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

voidclient.exe

windows10-2004-x64

6

voidclient.exe

windows11-21h2-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    installer.exe
  • Size 2.6MB
  • Sample260503-2s34vsds7n
  • SHA256 e3782fee3da51e158e41b1c569e0682666fa89741e9f04edfce6f3837b8e3d5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverytrojan

Malware Config

Targets

    • Target
      installer.exe
    • Size 2.6MB
    • SHA256 e3782fee3da51e158e41b1c569e0682666fa89741e9f04edfce6f3837b8e3d5a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoverytrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 15KB
    • SHA256 32e35e4b97f8df08f07d8879ba2ec963c75707440cfc0275e944a31c946f633f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsis_tauri_utils.dll
    • Size 32KB
    • SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      voidclient.exe
    • Size 10.9MB
    • SHA256 fe1ecf93ba392ce84330f5883cdce95c62376f3b320acfb18c865cc2fca3b7e8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverytrojan
    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Tasks