d319bd16c5186937e33b3b980bc3ccdeb0a63efef1a2bc3fbfd54f43f2e439d7

General

Target
Voicemod Pro 2.6.0.7 [updated].rar
Size 100.6MB
Sample240302-ysqa8agg9t
SHA256 d319bd16c5186937e33b3b980bc3ccdeb0a63efef1a2bc3fbfd54f43f2e439d7
MD5 8a0397541eef9260602d1346233e8624
SHA1 f4748c7374169419e9eb214c604fc767b5a43c17
SHA512 78081c4c208f034556f298fbc0196ba0855ed309e79030f6d0de09930608082e83dd1f88b1e293b492dacbbe76bc76e7ba24e8d363165ee025124801482e0a9b
SSDEEP 1572864:CG7qtFViZvvZCpf/oC+qqSXHHpKofCiEcaV/DtjAgdcbO:CGIqvI/oC+qqoIofold5R1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Voicemod Pro 2.6.0.7 [updated].rar
- Size 100.6MB
- SHA256 d319bd16c5186937e33b3b980bc3ccdeb0a63efef1a2bc3fbfd54f43f2e439d7
- MD5 8a0397541eef9260602d1346233e8624
- SHA1 f4748c7374169419e9eb214c604fc767b5a43c17
- SHA512 78081c4c208f034556f298fbc0196ba0855ed309e79030f6d0de09930608082e83dd1f88b1e293b492dacbbe76bc76e7ba24e8d363165ee025124801482e0a9b
- SSDEEP 1572864:CG7qtFViZvvZCpf/oC+qqSXHHpKofCiEcaV/DtjAgdcbO:CGIqvI/oC+qqoIofold5R1
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery evasion persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1
- Target
  Voicemod Pro 2.6.0.7/Crack/VoicemodDesktop.exe
- Size 5.3MB
- SHA256 176065ce145a080d2c13128c05d3f6ee83de37ca4b61aa3b4188c2d53b4f2725
- MD5 2a3c1a98a7e076e69e72173754be7828
- SHA1 cafd5d51d287fef1f7b8d3f75c6a91d573e0744f
- SHA512 fecc484293b5b13021f1d2b84e969c42c684a8e74b8f16d7017f8e9efd04935887f4b47f4acf153e62761a360fa6277db9433b25b4322173c258bfd841680e23
- SSDEEP 49152:wQgAw1Zh83bXY7rDNIgQUue5zg2+GS7vCco09j5B3fBolyKmyiIgQUue5zg2:wRAPbUDWdUuesCevZjQylWdUues
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  Voicemod Pro 2.6.0.7/VoicemodSetup 2.6.0.7.exe
- Size 97.2MB
- SHA256 1fdceb0506af1de8bf3050523305244fbbd18873410dd2475b50149e380902d0
- MD5 e6960258b89088493307f0c6bb2f4d86
- SHA1 ce0603a04002be2b415c4e8aae9f9e851e5b31b4
- SHA512 641b159e4aa9897ad481739540d1b7ff55af03a92ac5e2d6146d26ff9d688c125167b2512d38281bf4e19e8008a4486db49737a946ce078913a86b6c648c8406
- SSDEEP 3145728:PgtaN7mP3ulahwl9mJxjsOaw5Ud2OPMy2zo8:FS3uuI9mLP5UdSPzo8
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3