bfed49f602107675fa45a0cf917448a8de637a7692bb5a77301b41e5066404ed

Analysis

user interaction
yes
max time kernel
46s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.3.1-win64.exe
Size 83.9MB
Sample260916-v1j8dsdp7z
SHA256 bfed49f602107675fa45a0cf917448a8de637a7692bb5a77301b41e5066404ed
MD5 11e489a81c2f362d7d19b1ee236256c4
SHA1 d21bc83156d116e9f7b00c02d094c88d775031a0
SHA512 c3a3057316757cd9db236882b84926d84318a864e4bbfeedffbb4f83b9955abf2d21aa33085da122b8f1a860106c9b37c562cedbc00be1856c73fcb38fdb8367
SSDEEP 1572864:deoL13wTMjzynKhgaj/g3THohEgZRrkLKmY4DZ43cmh3ROSwQEuicij:t1365WfTg3DohxZRrkLKmY4DucQOggj
TLSH
T14018333BE39BB23DD42E4935B9379110A93B6D6074524D0A86F0CACCCF595B02E7E786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3220	VoidTools-Setup-v2.3.1-win64.tmp
4172	VoidTools.exe
1760	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
4172	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.1-win64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.1-win64.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2760-0-0x0000000000800000-0x00000000008DF000-memory.dmp	innosetup
behavioral1/memory/2760-7-0x0000000000800000-0x00000000008DF000-memory.dmp	innosetup
behavioral1/memory/2760-100-0x0000000000800000-0x00000000008DF000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	VoidTools-Setup-v2.3.1-win64.tmp
3220	VoidTools-Setup-v2.3.1-win64.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3220	VoidTools-Setup-v2.3.1-win64.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3220	2760	VoidTools-Setup-v2.3.1-win64.exe	86
PID 3220 wrote to memory of 4172	3220	VoidTools-Setup-v2.3.1-win64.tmp	92
PID 4172 wrote to memory of 1760	4172	VoidTools.exe	93
PID 4172 wrote to memory of 4512	4172	VoidTools.exe	95

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.1-win64.exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.1-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\is-MUKANJWX6B.tmp\VoidTools-Setup-v2.3.1-win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MUKANJWX6B.tmp\VoidTools-Setup-v2.3.1-win64.tmp" /SL5="$702B8,86747523,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.1-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:1760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=4172.4100.18243823738569849887
      4⤵
      PID:4512
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffec61eb078,0x7ffec61eb084,0x7ffec61eb090
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,14256819929628657428,5642930943606981949,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:2
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,14256819929628657428,5642930943606981949,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
        5⤵
        
        PID:4340
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,14256819929628657428,5642930943606981949,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:8
        5⤵
        
        PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 42.8MB
SHA256 666a908c86c205b520a73c016bb26676f6eb10e9a4ee62e29ddeea7084b454eb
MD5 07b92f7fc10d10bc5e181ab93bdf7043
SHA1 a8630cc36461cb150528aa55ada8a14f3bf4be45
SHA512 cd9197dfd27f44f5385eb74b287856263db9dc2432e892d3f9d822b12a41c56e7bd95161ad31ea7964c5fd45ae6257e2c85d79b7036b59b401f2933130a6b9e8
SSDEEP 393216:djWLwDfmzvFbwbD1/4d8cP38toZatH35yLYrt8Pc8S3rmW1PP+HyZrXfJMwGEbCU:djKwDAm6EKDS3qwiAfl
TLSH
T1ACA77D2B212405ADC486D677D5072D179365351BE3282EEF689C0F6F2BAB7DE1B32603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e088334c3de0e46a277f0729f4a70bfbc34767b3aa221b879aa674e4da96a468
MD5 869aaad7e1cd93b05ad4825df8a96d1e
SHA1 15eda3384d07d6aee3db14195e31bf04662f9302
SHA512 b57c68c7e2916eb783bf78bc1bf40b7bdc13fe18212a735adb3cb1bf91e024fd45f4d27a527c666e5ea9229ffa1d26dd08e02134f5dbeb56a8006557257e48ea
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 7aeecb50eefd23d60b2d94d3ed51bd1f3d7527e1c4d4c78147e081bf715e56bd
MD5 7eec014303eb2d1fda3835595dbcfb1c
SHA1 a6773e7a434d08f97d69967b65fc84195f0beb9a
SHA512 42e99bcbff624931d72cd0551643b5d50d5b768c6a4983e989819fbeba9d896e705901871e629a22e159df0b7b2eee0c427040013e17d9396467d4249b61165d
TLSH
T1BE31C772E0E42B32ED829A42B1176F67AF214076C2518F0CA1DD071C11FABCCA12AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597bcd.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe597bcd.TMP
Size 1KB
SHA256 fe1e69776ab7c58c70dcffa1f2741db57b4ba4a79ec3edb1bc67b3a00d1144c3
MD5 19ba7d681cecb1b00e20f9a5816795fa
SHA1 75801220aaa7c4d8714933e6ae6bdb9631c7be27
SHA512 d22445dd61188209ce64adfa0e40099b118449173cc5068b9b79de000d072c5f76d5112c6d604167a8027642c0f2c11867afa1832d7ea1ed6f4852f7ffc6833c
TLSH
T151219272D0D82B76F9828952F117AF966E108076D2508B0CE1CD022D21EAADCA266C73
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 2.1MB
SHA256 8a293fbdd2a632c813cb965e972dfdd10a3545756abc35b09fc6dacc06e1712f
MD5 353b95c3639b08862b9b36041966ed19
SHA1 64ce48712767d55685375173f9837d14cd6f0c48
SHA512 3ca9b713e37c0076823a2378f5b5e5da458c647a695c594b2290e83523ede8c39d6bd37634c53508665475abf062c907010c16da01c403fd6047beb30510c0a0
SSDEEP 12288:Mk2qQLpHWho/vmL+vpS0uWjaD2/v4wH2It:Mk2qmvmL+vpS0uWjaD2/v4wH2It
TLSH
T1B3A5E78011A49CD9F655A6B382E72C5C052AF03F255512F8F0C2F6DDD62FBA0C9A6C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 1.4MB
SHA256 50bdb893cd9542650f72f72df25916d89729fd5c252b9bd0ca0c19c8ad618cdc
MD5 4ab3ba4c2d0fed5b16e1e353a468455e
SHA1 d6df484d79e092bb6b0ee5b80417359e3c9a2d14
SHA512 8b2e4e4756f624299e5bb2070cc015513dff445e0d4daf08b624b2b2ade596815430d83330d542a2fd194d8de3faf3943adce3bc51d5946437266f3afd2f0ec8
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4p:6
TLSH
T1B2651430622FD3C3B7C0B115621C296F5AE5E1DEBA4A2CD12E89DDB443D494B9BDCA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.2MB
SHA256 b2c46ec657a5c4c79204f6abdbdb046fb1a0ebb5d4764eae850b4f6c66806e1f
MD5 46a37be68e5912d0891f73ac52473bf2
SHA1 b3542b13ea87200404a58b0a43aa5c54e79d55ee
SHA512 09214c60d7f6b768df7022b5718d097fe041962e04837f0eed7e3628cc8cc17b6fff874dd29b08b0aa22294220a5cca66efdf015d815fbd02d3136b0f53cb7d0
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZag:dgyt4hdcnLs1z1mL+J
TLSH
T1CBA61957E27710DDD5FAC07892177223F9A13C8C81346B6B499097A22B74B68AF3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.3.1-win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MUKANJWX6B.tmp\VoidTools-Setup-v2.3.1-win64.tmp
Size 4.2MB
SHA256 5d94316948d0519494d4b3b57ba8b86d3e3df339dbeb6d8b5bde89d68aee71a1
MD5 70dfd1fed24f492bfcc1a01a53dab58b
SHA1 a4ac5d43bc1ce34ed92a138ef9b3888a086e469e
SHA512 676154b76a5dfde758ccc879b43c76b533bead300f381d40236372380beb4c681ff9376405b3e282e8cf56aa4748e63fd31bde832f5ab39be1f9581248389e02
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb333M:+ItJj90Z6RgKwT
TLSH
T1D6168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2712-125-0x00007FFEE1E90000-0x00007FFEE1E91000-memory.dmp

Download

memory/2760-7-0x0000000000800000-0x00000000008DF000-memory.dmp

Download

memory/2760-0-0x0000000000800000-0x00000000008DF000-memory.dmp

Download

memory/2760-100-0x0000000000800000-0x00000000008DF000-memory.dmp

Download

memory/3220-91-0x00000000003F0000-0x000000000082A000-memory.dmp

Download

memory/3220-8-0x00000000003F0000-0x000000000082A000-memory.dmp

Download

memory/3220-9-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/3220-11-0x00000000003F0000-0x000000000082A000-memory.dmp

Download

memory/3220-5-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/3220-72-0x00000000003F0000-0x000000000082A000-memory.dmp

Download

memory/3220-86-0x00000000003F0000-0x000000000082A000-memory.dmp

Download