Overview

overview

5

Static

static

1

voicemail.exe

windows10-2004-x64

5

voicemail.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 06:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    voicemail.exe
  • Size 14.1MB
  • Sample260806-g2dkcavdmc
  • SHA256 2eb291bcf22a1e0bb5c2b7814a71f958979b2f48b014ea7ab19623a62e8ef39f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discoveryinstaller

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 61 IoCs
  • Executes dropped EXE 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\voicemail.exe
    "C:\Users\Admin\AppData\Local\Temp\voicemail.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Users\Admin\AppData\Local\Temp\is-MF5P9.tmp\agent.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-MF5P9.tmp\agent.tmp" /SL5="$401CA,14350441,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
          "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe" package.zip
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4816
        • C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
          "C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"
          4⤵
          • Executes dropped EXE
          PID:6000
        • C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
          "C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" /autoinstall
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3972
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 1956
            5⤵
            • Program crash
            PID:724
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3972 -ip 3972
    1⤵
      PID:2696

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          1.lng
          • Path C:\PROGRA~2\ADVANC~1\1.lng
          • Size 32KB
          • SHA256 0e5882114864d4a708b472d524063867fa770958b770b67fc0af7f8ed4757ad2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          services.ini
          • Path C:\PROGRA~2\ADVANC~1\services.ini
          • Size 3KB
          • SHA256 b3ff7c0a671e3d6cf02c2422fd7f0705bf4e22775e1b91e1fd4cf604bfc47646
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.ini
          • Path C:\PROGRA~2\ADVANC~1\settings.ini
          • Size 1KB
          • SHA256 00b1737cd06d79192a02ee090948e89f35ee9e22ca300411ec32322dd96fa5a8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.ini
          • Path C:\PROGRA~2\ADVANC~1\settings.ini
          • Size 1KB
          • SHA256 80d56449d9139e718fceb87ac173d5ce0afb1e64b7cf30e83fbd9167c279a7eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.ini
          • Path C:\PROGRA~2\ADVANC~1\settings.ini
          • Size 1KB
          • SHA256 2714a208e22c5804cfe61c4aa6d93fa7665087c7b4bd2f96219982da38434cd4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          debug.log
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
          • Size 2KB
          • SHA256 a06b265c534686b3fe14039cf1d77a14972bdc82b388505ba7a9233d51d3643d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          debug.log
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
          • Size 3KB
          • SHA256 4c3bb1676fda920d8ca23ce4d19a4cb9cec1db379e659af556af51272d13702c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          debug.log
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\debug.log
          • Size 5KB
          • SHA256 6b3264a49029925f2ab3a8a4de147037db500ea8e0788e6bd747f993cc5d00be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dsc.bmp
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc.bmp
          • Size 150KB
          • SHA256 5a8c508fd0a0a75a649ccb939454a0db0c5240f08551a179cb41e332bdbf7f18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dsc_header.bmp
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\images\dsc_header.bmp
          • Size 7KB
          • SHA256 a2acbb1b55df6a88829fbc4eb7881d8c39af8d4fb97d07cc9dc7bdba2229ea22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.ini
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\settings.ini
          • Size 1KB
          • SHA256 c1df9d743555c835ba381fd072b33252445dd030228f94ccc05d122fb2c36ed5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unzip.exe
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe
          • Size 778KB
          • SHA256 7560b1365c9bcb05462a02ff7cadbdba3f231b84d7437406dd5373fc44773865
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          winagent.exe
          • Path C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe
          • Size 13.8MB
          • SHA256 2aae6e6933d82ab84eaf8810f8538157850533622de14385f4c95c748cf06edc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          agent.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe
          • Size 14.0MB
          • SHA256 08caf67a3dc4036552d26b87773b63620b2fc12455c8477f130fae58ea77d0e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          package.zip
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\package.zip
          • Size 12KB
          • SHA256 0f7a6342c47e78678d19092ba2cfad9faa41a17a4f738ef881ab9df33a21a7cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          agent.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-MF5P9.tmp\agent.tmp
          • Size 690KB
          • SHA256 6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2196-114-0x0000000000400000-0x00000000004BC000-memory.dmp
          Download

          memory/2196-21-0x00000000006E0000-0x00000000006E1000-memory.dmp
          Download

          memory/4252-115-0x0000000000400000-0x0000000000414000-memory.dmp
          Download

          memory/4252-12-0x0000000000400000-0x0000000000414000-memory.dmp
          Download