7a2cd8ad7f8d9b1b29b16d7a337ab75bff7a5b5950c0e06d2879e5c1d116c818

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voidrun_decrypted.exe
Size 6.9MB
Sample260817-vp5d7ace97
SHA256 7a2cd8ad7f8d9b1b29b16d7a337ab75bff7a5b5950c0e06d2879e5c1d116c818
MD5 e366595c1b33e1a643105b34b3285d0a
SHA1 b0399b33dd2d52dfe97f8cd8315a41b8dbd26883
SHA512 765a093ad9238b3eff9147dfadd6b9b823e94e90f2675c8887b9d8cdc1e2ec8d6b6c7f29f8403ef1bf56d9dbf5163c3d066e0e16caca3917cb6e4d95f286e66d
SSDEEP 49152:Z3SDpxPfidJAeqYmHViP0fQAtA4oIhbUfGtN4FVzDkYxaTRamfzKmN5dG0+UNNGm:oOPENNG9pIUgjyfY+Z+kzSSLA9yi5B7
TLSH
T1DE769D787E7560DBF782F0776A90CC2117336DBD9341EEC02A85EA89BE43D5E24250E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DiagTrack\Parameters\ServiceDll = "%SystemRoot%\\system32\\diagtraсk.dll"	voidrun_decrypted.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MapsBroker\Parameters\ServiceDll = "%SystemRoot%\\system32\\mоshost.dll"	voidrun_decrypted.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DusmSvc\Parameters\ServiceDll = "%SystemRoot%\\system32\\dusmsvс.dll"	voidrun_decrypted.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
1	discord.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\shеll32.dll	voidrun_decrypted.exe
File created	C:\Windows\System32\diagtraсk.dll	voidrun_decrypted.exe
File created	C:\Windows\System32\mоshost.dll	voidrun_decrypted.exe
File created	C:\Windows\System32\dusmsvс.dll	voidrun_decrypted.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	voidrun_decrypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	voidrun_decrypted.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2156	taskkill.exe
5144	taskkill.exe
3288	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 5144	3276	voidrun_decrypted.exe	88
PID 3276 wrote to memory of 3288	3276	voidrun_decrypted.exe	92
PID 3276 wrote to memory of 2156	3276	voidrun_decrypted.exe	94

C:\Users\Admin\AppData\Local\Temp\voidrun_decrypted.exe
"C:\Users\Admin\AppData\Local\Temp\voidrun_decrypted.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /FI "SERVICES eq MapsBroker"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5144
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /FI "SERVICES eq DoSvc"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /FI "SERVICES eq DiagTrack"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads