a64aae8ca425ae2b2cca1b466338c9352f1eaec0e1087408f40f101c84de226c

Analysis

user interaction
yes
max time kernel
72s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoicemodInstaller_1.6.22-jpf09a.exe
Size 6.1MB
Sample260804-mfl79atsf1
SHA256 a64aae8ca425ae2b2cca1b466338c9352f1eaec0e1087408f40f101c84de226c
MD5 818e4a21a7328b462ee4448566325873
SHA1 647d196e2dc318c3b93410ae7381e97b102fa823
SHA512 1c39cc4bf135b547f99aa3751e1ca660a47b3f56b544c0c88d0e902b72c4ac84b1147a8ef0de36c513f46193ef08df743d98e2907a9f88a6de001d94731dba6b
SSDEEP 98304:K1QTgb/jF2LPpBe5QPHoR8ra8qspnNSgU7nnWNEjeMzkyuuG:2BrUPpUMHoqrf/onW+1M
TLSH
T1F5561223A784E43ED19A67344132E27494FBAF69B813DD11B6F4CC4FFB155C11E2AA22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution installer

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5024	tasklist.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	VoicemodInstaller_1.6.22-jpf09a.tmp

Loads dropped DLL 1 IoCs

pid	Process
2356	VoicemodInstaller_1.6.22-jpf09a.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.22-jpf09a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.22-jpf09a.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4480-0-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup
behavioral1/memory/4480-11-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2356	4480	VoicemodInstaller_1.6.22-jpf09a.exe	84
PID 2356 wrote to memory of 4460	2356	VoicemodInstaller_1.6.22-jpf09a.tmp	86
PID 2356 wrote to memory of 404	2356	VoicemodInstaller_1.6.22-jpf09a.tmp	90
PID 2356 wrote to memory of 4512	2356	VoicemodInstaller_1.6.22-jpf09a.tmp	92
PID 4512 wrote to memory of 5024	4512	cmd.exe	94
PID 2356 wrote to memory of 260	2356	VoicemodInstaller_1.6.22-jpf09a.tmp	95
PID 2356 wrote to memory of 4080	2356	VoicemodInstaller_1.6.22-jpf09a.tmp	106
PID 2356 wrote to memory of 1360	2356	VoicemodInstaller_1.6.22-jpf09a.tmp	108

C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.22-jpf09a.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.22-jpf09a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\is-G58OC.tmp\VoicemodInstaller_1.6.22-jpf09a.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G58OC.tmp\VoicemodInstaller_1.6.22-jpf09a.tmp" /SL5="$5029A,5563930,899584,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.22-jpf09a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4460
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -v https://api2.amplitude.com/2/httpapi -H "Content-Type: application/json" -X POST -d "{\"api_key\": \"eaad02071e6aab9757abf9b6ece09b8e\",\"events\": [{\"device_id\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce\",\"event_type\": \"Installer Open\",\"insert_id\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce-20260804112513\",\"app_version\": \"1.6.22\",\"platform\": \"Windows\",\"os_name\": \"Windows\",\"os_version\": \"10 (10.0.19041)\",\"ip\": \"\",\"event_properties\": { \"version\": \"1.6.22\", \"machine_guid\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce\", \"country\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"operating_system\": \"Windows\", \"operating_system_version\": \"10 (10.0.19041)\", \"voicemod_system\": \"voicemod-v3-installer-windows\", \"cpu_architecture\": \"x86_64\", \"download_id\": \"jpf09a\" }}]}"
    3⤵
    PID:404
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:260
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -v https://api2.amplitude.com/2/httpapi -H "Content-Type: application/json" -X POST -d "{\"api_key\": \"eaad02071e6aab9757abf9b6ece09b8e\",\"events\": [{\"device_id\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce\",\"event_type\": \"Installer Downloading VC x64 Redistributable\",\"insert_id\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce-20260804112546\",\"app_version\": \"1.6.22\",\"platform\": \"Windows\",\"os_name\": \"Windows\",\"os_version\": \"10 (10.0.19041)\",\"ip\": \"85.203.46.39\",\"event_properties\": { \"version\": \"1.6.22\", \"machine_guid\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce\", \"country\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"operating_system\": \"Windows\", \"operating_system_version\": \"10 (10.0.19041)\", \"voicemod_system\": \"voicemod-v3-installer-windows\", \"cpu_architecture\": \"x86_64\", \"download_id\": \"jpf09a\" }}]}"
    3⤵
    PID:4080
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 21B
SHA256 9e4bde6d997692558a47d0a569846a8c2c1b45bc619ebb16f36c08d6b1e28790
MD5 8a80061c11956525e5354d01a2604150
SHA1 44757e02561517bb9ed5ed487de92333f49fba41
SHA512 65e1d31403ea587ef509f97bb435356cb857a6364f3f6b2fb80aac79fbacd5b193d2cb010d6da812b977a23008a7fb16b960040b7ef405a658b5b992c7cae6f3
MD5 SHA1 SHA512

Submit Download

VoicemodInstaller_1.6.22-jpf09a.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G58OC.tmp\VoicemodInstaller_1.6.22-jpf09a.tmp
Size 2.6MB
SHA256 f8952d37c37a3e7ff62bbf4a0a329355ac953c6ced4ffd5c526ec7299dcc7892
MD5 c5c1e99f67039f52d81718bebdeb6957
SHA1 e7bbf0712538ecb2cf863ca8f38a67c453800045
SHA512 f9387226a53dcaf9776c0aa549b52e4049318d4e2e962a00adc41d925cac9d2368891aedf9daaa7bbfd8e6ece09b85697e3d4cd96342a44df70430bf28a79421
SSDEEP 49152:D/bMELtKnwSaPuqrUJlORnUjzV8VkLwkf:DjMzVPeVC3
TLSH
T193C54B12B384B13FD06B2A35643BC670993FBE5179B3CD166BF41D0DAF355802B2AA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LKFL0.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasklist_unins000.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
Size 7KB
SHA256 31c6b1fe94f1a6c7d525c68dd225a9f0b732ac9988f27ac88dd20ce4534d4bee
MD5 c8377e555302746f0fc7251a2c21704d
SHA1 ce7ead7e52ce2a3984079c04924b266710270215
SHA512 fcc0c577e71afb85ddc49e5ffec2680f8797b9fffcae0838c0c3c7d8a1b556dfd6dc017ef028ea119d33138b36872af1aa44e6fabc437570eb2cc3c0d87fa2a9
SSDEEP 192:TZi0EfNzJbGZvMRvn+iyhDsy5ZPRXJd5CpMtMVb0fFBQIaGotjPBL4ac74aFStKo:TZi0EfNzJbGZvMRvn+iyhDsy5ZPRXJda
TLSH
T1B0E1FE85899F45EC952DD3983E230002EB0E150031BAADD93ADE14EC77E5F1DE7EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-5-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/2356-12-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/2356-13-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/2356-17-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/2356-23-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/2356-31-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4480-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/4480-11-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads