Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dramatic/VoidCoD.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dramatic/VoidCoD.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Dramatic/VoidCoD.exe
- Size 2.2MB
- Sample260702-e42zlsbx7v
- SHA256 60873671ceb7ec6fafa8ccd9480a10ac08dc642d9aee690c69464d354ab045e5
- MD5 76f150e8688427807d2e3f8d56c1f1f7
- SHA1 c1b545a1b327a5ed0ab3baf8c3059002282c700b
- SHA512 7b733bbdea3e9c0b0979f8db44bae6bbbfdf21eb73a063ebc192c48018504f72ac8bcd2849f48eb7b71610776de8c2657e0e86ce170749d07e2b3e0f61123676
- SSDEEP 49152:Jtnn4a0v7K+NVZ3NnSRPkjzCxeARZx45nTzrSelt6moYlkEkIuJArH+O93+x:vCVZ3NnSRPkjzCx+Xt6JjEkorHru
- TLSH T1FBB5CF5BA7B410F4C1B7C13CC142561BFAB2746503709BEB66D08A6B1F637E4AA3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 7 api.ipify.org - Delays execution with timeout.exe 1 IoCs
pid Process 1668 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe 1864 VoidCoD.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1916 wmic.exe Token: SeSecurityPrivilege 1916 wmic.exe Token: SeTakeOwnershipPrivilege 1916 wmic.exe Token: SeLoadDriverPrivilege 1916 wmic.exe Token: SeSystemProfilePrivilege 1916 wmic.exe Token: SeSystemtimePrivilege 1916 wmic.exe Token: SeProfSingleProcessPrivilege 1916 wmic.exe Token: SeIncBasePriorityPrivilege 1916 wmic.exe Token: SeCreatePagefilePrivilege 1916 wmic.exe Token: SeBackupPrivilege 1916 wmic.exe Token: SeRestorePrivilege 1916 wmic.exe Token: SeShutdownPrivilege 1916 wmic.exe Token: SeDebugPrivilege 1916 wmic.exe Token: SeSystemEnvironmentPrivilege 1916 wmic.exe Token: SeRemoteShutdownPrivilege 1916 wmic.exe Token: SeUndockPrivilege 1916 wmic.exe Token: SeManageVolumePrivilege 1916 wmic.exe Token: 33 1916 wmic.exe Token: 34 1916 wmic.exe Token: 35 1916 wmic.exe Token: 36 1916 wmic.exe Token: SeIncreaseQuotaPrivilege 1916 wmic.exe Token: SeSecurityPrivilege 1916 wmic.exe Token: SeTakeOwnershipPrivilege 1916 wmic.exe Token: SeLoadDriverPrivilege 1916 wmic.exe Token: SeSystemProfilePrivilege 1916 wmic.exe Token: SeSystemtimePrivilege 1916 wmic.exe Token: SeProfSingleProcessPrivilege 1916 wmic.exe Token: SeIncBasePriorityPrivilege 1916 wmic.exe Token: SeCreatePagefilePrivilege 1916 wmic.exe Token: SeBackupPrivilege 1916 wmic.exe Token: SeRestorePrivilege 1916 wmic.exe Token: SeShutdownPrivilege 1916 wmic.exe Token: SeDebugPrivilege 1916 wmic.exe Token: SeSystemEnvironmentPrivilege 1916 wmic.exe Token: SeRemoteShutdownPrivilege 1916 wmic.exe Token: SeUndockPrivilege 1916 wmic.exe Token: SeManageVolumePrivilege 1916 wmic.exe Token: 33 1916 wmic.exe Token: 34 1916 wmic.exe Token: 35 1916 wmic.exe Token: 36 1916 wmic.exe Token: SeIncreaseQuotaPrivilege 680 wmic.exe Token: SeSecurityPrivilege 680 wmic.exe Token: SeTakeOwnershipPrivilege 680 wmic.exe Token: SeLoadDriverPrivilege 680 wmic.exe Token: SeSystemProfilePrivilege 680 wmic.exe Token: SeSystemtimePrivilege 680 wmic.exe Token: SeProfSingleProcessPrivilege 680 wmic.exe Token: SeIncBasePriorityPrivilege 680 wmic.exe Token: SeCreatePagefilePrivilege 680 wmic.exe Token: SeBackupPrivilege 680 wmic.exe Token: SeRestorePrivilege 680 wmic.exe Token: SeShutdownPrivilege 680 wmic.exe Token: SeDebugPrivilege 680 wmic.exe Token: SeSystemEnvironmentPrivilege 680 wmic.exe Token: SeRemoteShutdownPrivilege 680 wmic.exe Token: SeUndockPrivilege 680 wmic.exe Token: SeManageVolumePrivilege 680 wmic.exe Token: 33 680 wmic.exe Token: 34 680 wmic.exe Token: 35 680 wmic.exe Token: 36 680 wmic.exe Token: SeIncreaseQuotaPrivilege 680 wmic.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1864 wrote to memory of 1916 1864 VoidCoD.exe 86 PID 1864 wrote to memory of 680 1864 VoidCoD.exe 101 PID 1864 wrote to memory of 5072 1864 VoidCoD.exe 106 PID 5072 wrote to memory of 2884 5072 cmd.exe 107 PID 5072 wrote to memory of 3236 5072 cmd.exe 108 PID 5072 wrote to memory of 2988 5072 cmd.exe 109 PID 1864 wrote to memory of 1656 1864 VoidCoD.exe 113 PID 1656 wrote to memory of 4748 1656 cmd.exe 114 PID 4748 wrote to memory of 1668 4748 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dramatic\VoidCoD.exe"C:\Users\Admin\AppData\Local\Temp\Dramatic\VoidCoD.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dramatic\VoidCoD.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dramatic\VoidCoD.exe" MD53⤵PID:2884
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3236
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"2⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:1668
-
-
-