73c91655e360d3947d27f26da92b02b950c738e937978689b069c189f8ef074f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
release/VoidClient.exe
Size 17.7MB
Sample261024-qjvkksh15s
SHA256 73c91655e360d3947d27f26da92b02b950c738e937978689b069c189f8ef074f
MD5 31903b968cf6a8e2cdc19d4493d3f943
SHA1 fe6b38dd1d988551216844f0d5cd4f2fef5c7569
SHA512 1caefb32c80b911a4c2cd4e0bbe6283f8c9592d8deca0ce4663c29eee9601ec8e10ae64c42e83ab3d5fde74ba0566173696939e80c276e38a5a3773abd7f3e70
SSDEEP 98304:iDxD+ugYLtZ55jgDmXtzNOzZI9tCMSddI42ScL+5Cj1o5m2Si19vWvQrBjR9T17L:6G+McxQtm42SM+5Yi3wQrdB
TLSH
T177179E93B5C71CE9C993A77995DF6337B731BE1092246B635A04EA301EA36C0AF1B704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VoidClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VoidClient.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	VoidClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	VoidClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	VoidClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	VoidClient.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\URL Protocol	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\shell\open\command	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\shell\open	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\ = "VoidClient Map File"	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\DefaultIcon	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\shell	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\release/DDNet.exe\" \"%1\""	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\shell\open\command	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\release/DDNet.exe\" \"%1\""	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\release/DDNet.exe\",0"	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\FriendlyTypeName = "VoidClient Map File"	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\shell\open\command	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\release/DDNet.exe\",0"	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\ = "URL:ddnet Protocol"	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.map	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\FriendlyTypeName = "VoidClient Demo File"	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\release/DDNet.exe\" \"%1\""	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\release/DDNet.exe\",0"	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.map\shell\open	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\ = "VoidClient Demo File"	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.demo	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\DefaultIcon	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ddnet\shell	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\DefaultIcon	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\shell	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.map\ = "VoidClient.map"	VoidClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\VoidClient.demo\shell\open	VoidClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.demo\ = "VoidClient.demo"	VoidClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4932	VoidClient.exe

C:\Users\Admin\AppData\Local\Temp\release\VoidClient.exe
"C:\Users\Admin\AppData\Local\Temp\release\VoidClient.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axiom.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\axiom.png
Size 6KB
SHA256 756a919ed126aa1b99feb2992980f3b521c6870d02728195f0aed23da1d57f0a
MD5 a774cb3dc96887db17d62951281497a1
SHA1 368b2dd724e43a9fbe23929cae72d8f1f0293cc2
SHA512 fbfd6ec724e389d131bda9ece655b081ee5e86b5be0bc7e8974ab7307761c4d4227679af33d4ee703424c2ee815a55aded5ecbe643265388071b1afe78563fda
SSDEEP 192:+hrE7V8zOeKESpCp10nV60/S71XqNWFpxLxuuN:+i7q5RSe0nkESvLxuuN
TLSH
T1DFE18EC10B6BD1C96C5CF09951966603233D1090EB213BFEB225FD5B994A385CF8DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blockworlds.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\blockworlds.png
Size 18KB
SHA256 b53b6b216c92c48df77f38191f103f2daa4d17cd438a852e2d7c1184abf881d4
MD5 6448940a6611a6b271403a5ac74df868
SHA1 07d0d4b78f6cdc47e8091162e30396f1bddb6116
SHA512 b6b4ab5094b985a7e1dc84e446f80d5d78973cdbeb6a321d14785b0ec3865651d1211ae03b0b584ef4cc3c5ae256ede98b4fe68644abbe5ff8e3c1694c870cd6
SSDEEP 384:XxNKy67dT4zK/w5ROJLiGVbkPue4OYUx7iZyR6R1V0XY2:Xx0a8wWJLxq34O/7iQ0J52
TLSH
T11482D1135A18FD4AD20914E8CAD7305DC2334BC678BE0A8665AD65850C7299E832EBDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddnet.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\ddnet.png
Size 5KB
SHA256 267f137cd7fc4e3843e54b6e6bf664e50da77826abe1675d1d3e87a18a5952de
MD5 d0be803cf388203018c12b2c48ee4428
SHA1 5827459b97c0770c437b8bc0bb1d71f9d1258f19
SHA512 02730937128917f213108e49e064ce7d32725282da4b27c1ba64198290615210ef0c0f348ddd0b1f358d1482fd721ee438630c3290e74938f9498d12a3b8561a
SSDEEP 96:90t6kUE1XdjijhjLisoq3MCjeBJYDU848doELfssoUl5w1zexaPe7IEdF7fnxZkR:yt1XdG5doq0BJYDU8JvhlG1zexa4IYh8
TLSH
T1C7B16DDD47FE6DA677C14E4213ACCA8142810BAE469115A15E948FBFD4D362C3EC8D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kog.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\kog.png
Size 7KB
SHA256 0e03883eef526f7991076e57b634b84656438bc255e86fe93bfa5b8ac6fa2869
MD5 6f155650c8513f393a52f8a25f235a67
SHA1 948a18ee79cb7059e34eda553686208d282f8545
SHA512 cff504d78ae7d9b9e256ae782e088c1df4962da3f3893794157bd9b9ab37edbc2d066448304f133464acda090885f5027c5b97b06baf11ab6f3bb920f89fe731
SSDEEP 192:Jk0fr5WwdUxIZZBVOrmG1lRaxKTom55FZPT:y0fn48BV0N+KTt553PT
TLSH
T162E17D80F99804D1D7CE2B285CC91459FF6A06A28FA20C927FE51A020F747E38DA99C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nobyfng.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\nobyfng.png
Size 11KB
SHA256 e36a3ef0458d815ae650fe01dfb6bf0e71c423a5c3edceca8791dc969fd51f5d
MD5 96068d58f567bbf13e3163c31cc1c357
SHA1 210e3d792c1175e25da7b3e5055e15a2c5c29e38
SHA512 3ce28d517c48eb9eb0998c4a7e5e5b077b2907db14dcb878c0dd04159c3f7bd7e287ae7fdc8b546f1bdcbe1a9453665dcd1d3c41be5d1c032dd6bf83a529dc6a
SSDEEP 192:xFHrkqPGTNRq5Wx+7nII/t9Aumri+xaqlBahl8+rbO/fLbQI5Vg:xFgvM4cX9AbiCaqSl8sa/J5i
TLSH
T1CF329E1AD7613312E6CEA4A78AEC124CDD038052D9A3DCBAB58F4D0A4F703F55C5B2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntcn.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\ntcn.png
Size 7KB
SHA256 e03279893461b10428d5e59fef484641c4e340b55b656292fcf662bfb0896bbb
MD5 e9becc7f1cf6cd81f547c50e31e9fd0b
SHA1 83ba86b328f3c539fcece2c944973e1c0f6a1103
SHA512 90b4da6d385211f0e6e45142b5dee60825ccef273031e22a8be148d5ac73638b4058753371cd2e0616b4b5fd3a7270c95dbefc039a062e6dcbbab64dee4bd413
SSDEEP 192:ZnC3wlQSAIwB461EbyadDqdznvo/vV7OTVQlZllM8HOMuzvMi:U3wlQSGBAycD8zAXV7OTKTCMCN
TLSH
T1DFF1AF52B7572E8E6E8E39E3157D2B306425128EC2BE1F2BC555B2280C98CD52F350AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teefusion.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\teefusion.png
Size 3KB
SHA256 3f78ab56c3522f114d7788f50964b90d31f8f8cc3b6c003afabcbc1b463dfd06
MD5 e429a046984732d422e8b3d8e66426e6
SHA1 dbc04278ac18fb21bcfbc1817c1e767f011bd655
SHA512 e329969bc5d4cdfab750fd15d66058749e8109871551c10dae8334ad76682705a47814e9a93828229feaf6686352f15468a1b4c9fb30ca52deab4e350440c6da
TLSH
T1D181A549FB0069119A9DEA47B9FFD19717371B90C6D1E093BDC68C022C602B9CA5EAC6
MD5 SHA1 SHA512 TLSH

Submit Download

unique.png

Path C:\Users\Admin\AppData\Roaming\DDNet\communityicons\unique.png
Size 9KB
SHA256 e8f6686fad28b9e5dc8fa140bdbd8a12baef540be2f5f8ae7578455965d2b33a
MD5 c0626fe96a4011ff07e7bd37b77a3093
SHA1 7e1eb05921db451aafb67e27e17217f691dc6fad
SHA512 3c3b01cec7de1370f40fe8a1d59041969e3635ec509a067827bb441b1133e74e60c6af6211412f4bff713c3d805d85c0fff0b9fb97daafc5c62dbe618715554b
SSDEEP 192:S0k3Q274zGSs1nm/YBFIyYkyOMDH1Tl3p6lhjRx/iNaK:0xk1LwF3YSMDpl3pO8r
TLSH
T10E129F2CB40130E6054BFE9F25E2456D9A030763A6C49DF9BAEF649E4F4C3C6199B173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddnet-info.json

Path C:\Users\Admin\AppData\Roaming\DDNet\ddnet-info.json
Size 88KB
SHA256 dba0781821308f27917203a7e3f43f9de59eca219d56f9a0a3316adc2c596710
MD5 2e2fcaa56422b82aca7f52d4b9fe59e4
SHA1 e31151cb54faf11ba800767cf651536fd926b521
SHA512 20da06778a5a33eeb04388b705d29d10561c763eca0c560a76080aef3096b46d73da61ac3c45860ad97702fc0d31b73376ffcb2b1b02219846024e0c06da33ef
SSDEEP 768:9mx/m36sF3gSOR90mEeBbm/D5CRj39AJY1V7BcOz0AUmrf+xStd:A/mPDe90mEeQ/D5CtGJs7Bnzz9
TLSH
T17B931E79DA404FE00A9CC51824A629C7510842678C873999FFDF076C6F6E42F3DFA69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4932-14-0x00007FFD05EF0000-0x00007FFD0612C000-memory.dmp

Download

memory/4932-4-0x00007FFD14880000-0x00007FFD1492F000-memory.dmp

Download

memory/4932-12-0x00007FFD14CF0000-0x00007FFD14D3E000-memory.dmp

Download

memory/4932-11-0x00007FFD1A570000-0x00007FFD1A585000-memory.dmp

Download

memory/4932-9-0x00007FFD15040000-0x00007FFD15068000-memory.dmp

Download

memory/4932-8-0x00007FFD06360000-0x00007FFD06407000-memory.dmp

Download

memory/4932-10-0x00007FFD062B0000-0x00007FFD06360000-memory.dmp

Download

memory/4932-19-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-6-0x00007FFD07530000-0x00007FFD078FF000-memory.dmp

Download

memory/4932-15-0x0000000064940000-0x0000000064955000-memory.dmp

Download

memory/4932-16-0x00007FFD14FC0000-0x00007FFD14FD2000-memory.dmp

Download

memory/4932-17-0x0000000062E80000-0x0000000062EA6000-memory.dmp

Download

memory/4932-7-0x00007FFD06410000-0x00007FFD07524000-memory.dmp

Download

memory/4932-18-0x00007FFD05E50000-0x00007FFD05EE2000-memory.dmp

Download

memory/4932-3-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-13-0x00007FFD06130000-0x00007FFD062AA000-memory.dmp

Download

memory/4932-5-0x00007FFD07900000-0x00007FFD07987000-memory.dmp

Download

memory/4932-80-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-96-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-112-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-128-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-144-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-160-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-176-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-192-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-208-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-224-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-240-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

memory/4932-256-0x00007FF619AD0000-0x00007FF61A7FA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads