734ca4595a25a8b4f45836e6534c07d21bba029d3151058e53bdf36a00a40f3f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoicemodInstaller_1.6.13-l2wy2i.exe
Size 6.1MB
Sample260523-wheevsfy3l
SHA256 734ca4595a25a8b4f45836e6534c07d21bba029d3151058e53bdf36a00a40f3f
MD5 eb211f8ce6f3c51b0fa11269692918b1
SHA1 795422f5c8ef9df7a791c47f532d9298c6ed04c5
SHA512 088c3986b767dad91e3c61d9f9b5610915e775106b63d38b9c8b72da7a732556a56391c168ff0355101abb1c2da07c2052744b7dc95ba57a509943b76b81ac66
SSDEEP 98304:W1QTTb/jF2LPpBe5QPHoR8Rn96Oag+v7H7L9AuBR9Y44hihJYq0ig1yhmKutW:a2rUPpUMHoq198v7bOuBfhlJphVutW
TLSH
T1285612267344E43AD09A67344172E27494FBAFA8B817ED1276F4CC4FFB255C11E3AA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery installer

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1252	tasklist.exe

Executes dropped EXE 1 IoCs

pid	Process
4008	VoicemodInstaller_1.6.13-l2wy2i.tmp

Loads dropped DLL 3 IoCs

pid	Process
4008	VoicemodInstaller_1.6.13-l2wy2i.tmp
4008	VoicemodInstaller_1.6.13-l2wy2i.tmp
4008	VoicemodInstaller_1.6.13-l2wy2i.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.13-l2wy2i.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.13-l2wy2i.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1464-0-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup
behavioral2/memory/1464-11-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	tasklist.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4008	1464	VoicemodInstaller_1.6.13-l2wy2i.exe	80
PID 4008 wrote to memory of 4104	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	81
PID 4008 wrote to memory of 3308	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	83
PID 4008 wrote to memory of 2896	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	85
PID 2896 wrote to memory of 1252	2896	cmd.exe	87
PID 4008 wrote to memory of 5472	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	89
PID 4008 wrote to memory of 2464	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	91
PID 4008 wrote to memory of 5548	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	93
PID 4008 wrote to memory of 3788	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	95
PID 4008 wrote to memory of 1076	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	97
PID 4008 wrote to memory of 5616	4008	VoicemodInstaller_1.6.13-l2wy2i.tmp	99

C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.13-l2wy2i.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.13-l2wy2i.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\is-J32AU.tmp\VoicemodInstaller_1.6.13-l2wy2i.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-J32AU.tmp\VoicemodInstaller_1.6.13-l2wy2i.tmp" /SL5="$40234,5563686,899584,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.13-l2wy2i.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4104
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"mp_deviceid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.212\",\"environment\": \"production\"}"
    3⤵
    PID:3308
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:5472
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"mp_deviceid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\",\"events\": [{\"data\": {\"event_name\": \"Installer Downloading VC x64 Redistributable\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.159\",\"environment\": \"production\"}"
    3⤵
    PID:2464
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:5548
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"mp_deviceid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\",\"events\": [{\"data\": {\"event_name\": \"Installer Downloading VC x86 Redistributable\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.212\",\"environment\": \"production\"}"
    3⤵
    PID:3788
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1076
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\"},\"mp_deviceid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"da90beae-a17a-43c1-9de4-43074024f1a5\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.159\",\"environment\": \"production\"}"
    3⤵
    PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 22B
SHA256 d2e9a5518225489d722bda63663d91606b8cf69b6ca0bbadf10cd37dc9470076
MD5 9d60a33a61ca42480ce1f4056a322bf0
SHA1 4a1ff8e768d2d2a610dd8b1a1fec683bf97ec0bd
SHA512 f7db712bc12eabcd90d6116da3f4ff2cedce24eb674422c51890e188ae228346e1cfc6c545f62bdbf20ca16440bf58e0282e7427def408678491bfc5cf16d6db
MD5 SHA1 SHA512

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 22B
SHA256 71892a1802dd9bcc00334b43d13007c92fb7f8357889ed67cc374fcfc22c30f8
MD5 94d6158ed51190c87a01d182ea2f5f2d
SHA1 c5ee885e4137e598fb9a824524ffec84e01e3453
SHA512 f07fd59b4517a84401f251a1b7219199eaa799df0b77b0526a21038f9bbe5b71db259e952899f1248e77923dc9f6120c04455af9e5e9e551b577505a9ffd622a
MD5 SHA1 SHA512

Submit Download

bg-inner.png

Path C:\Users\Admin\AppData\Local\Temp\is-IKPF0.tmp\bg-inner.png
Size 6KB
SHA256 8fe4a3f95d5309e692c4142f460bebe4e4e24844f5a2071d466bd964c5d04dcf
MD5 a034eeaf19bb82b2ae63f4fa10c26476
SHA1 617c9ef4b889e424e754574d62649f04c97bcc67
SHA512 c1ffd444da1378620428b374501de974a33e898e38a9d94e88ee5977951aba89fbad033ffbac65051e021fb96dfa9039872f8dc6441de1dfea01c39c8a8ecb20
SSDEEP 192:sSTdK8Lk27YvkgtGwZfgSwPLX51gjmzGj:r48Lk27YMSZIrPLXIck
TLSH
T19CE1AFEAD7970B2830739A902189B07B695FD8723354F315DD3AD30B191A4ECC61F563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg-top.png

Path C:\Users\Admin\AppData\Local\Temp\is-IKPF0.tmp\bg-top.png
Size 20KB
SHA256 bdc753b2b19ee8b573b8e676f18dae42494b99b6bd738194dcdd67f244085f36
MD5 220fe6e00519a633d9ad7d1d50adc4c7
SHA1 cfcadd75996d6f1cb42c43480d24e52dd72bd917
SHA512 1f00db2aab3585aff016188f12f953e832d027161076887cde42b99dab581e2396c9bfb919c43e01fd8c823f79a81425238a8c5235b47be55d7dfdcc1d190ec3
SSDEEP 384:P5Z7BD9bMqsjNoUbBj1N/YsHFc9e0UV7Js52F0pTogUm8GhDpy01BtXUIKH5Xb:BZn4q5kBx2sl2+JK2FSTlUm84YqtXv6r
TLSH
T11992E18DB6680FF386C4F03C992BC03BE679FD69986567059A050FD51C627C94DF2A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IKPF0.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buttons.png

Path C:\Users\Admin\AppData\Local\Temp\is-IKPF0.tmp\buttons.png
Size 1KB
SHA256 d236f88ef90e6d0e259a586f4e613b14d4a35f3a704ff559dadda31341e99c24
MD5 87cc673665996a85a404beb1c8466aee
SHA1 df01fc67a739544244a0ddabd0f818bd960bf071
SHA512 2058e3fd362c689a78fb3d0a163fd21bfe472368649c43dc8e48b24fa4bc5ed1307faf1cab2c351a4dd28f903a72d4951a72d7eb27784fee405884661a259c32
TLSH
T11341FC65E38A45BBF034A13935251813A4041C3BB04FEE2545A375AF2363F2ABD31E47
MD5 SHA1 SHA512 TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IKPF0.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemodInstaller_1.6.13-l2wy2i.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-J32AU.tmp\VoicemodInstaller_1.6.13-l2wy2i.tmp
Size 2.6MB
SHA256 2e67ed333d85a2b59bc7783cad45b64a0db7783997c4581f967628b0710fec11
MD5 94092b0ed8c1698493ae00bd9b373b0f
SHA1 6ca12541a11bdd297e78fdb1a7c2a3106a0c14b7
SHA512 5b6a48b14a0a9e2cb178b9ed48ccdddfc4689b3d528d20ab99ea3a269da21255f2d65c07054bba12e0ebec1f5b749e34e5742db48164f7d4f0da052ce90af85c
SSDEEP 49152:F/bMELtKnwSaPuqrUJlORnUjzV8VkLwkQ:FjMzVPeVCY
TLSH
T1F8C54B12B384B13FD06B2A35643BC670993FBE5179B3CD166BF41D0DAF355802B2AA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasklist_unins000.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
Size 6KB
SHA256 e9ce42b2d39d39217416d41db68fc81b295accd5965b9a43db8e4ff1b29987d3
MD5 b8476e00f9da370254a90c8040ab83d4
SHA1 8b9f24f62712cb7b4b414426ac95d3b37c9c4cbd
SHA512 6647438c1916c315279d94e0e4aa21b7fb0447d9ef1dc5567f35958acd5f20f32fd148f8163358486fb00d9cb5ce99508c824d4f0b29933b967d6faee9e5f6dd
SSDEEP 192:+LVAnSnGnTi+TkgC0MF3+JjbjdWlvwE7MZgYtKCG3FwoXXxM+9WkCOi7OFh27hnO:+RAnSnGnTi+TkgC0MF3+JjbjdWlvwE7H
TLSH
T116E1CE8588CF45EC956DD3983A130002EB4E6541316AADD93ADE14EC77E4F2CE7EBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-11-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/1464-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/4008-105-0x00000000035F0000-0x0000000003730000-memory.dmp

Download

memory/4008-125-0x0000000003C70000-0x0000000003C7E000-memory.dmp

Download

memory/4008-12-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-13-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/4008-115-0x00000000035F0000-0x0000000003730000-memory.dmp

Download

memory/4008-100-0x00000000035F0000-0x0000000003730000-memory.dmp

Download

memory/4008-120-0x00000000035F0000-0x0000000003730000-memory.dmp

Download

memory/4008-110-0x00000000035F0000-0x0000000003730000-memory.dmp

Download

memory/4008-5-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/4008-40-0x0000000003C70000-0x0000000003C7E000-memory.dmp

Download

memory/4008-124-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-127-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-130-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-133-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-136-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-139-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-142-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-145-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4008-149-0x0000000003C70000-0x0000000003C7E000-memory.dmp

Download

memory/4008-148-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads