100dba151efe66c842fde4337857fd3db4568c1e3ee008e412927e67ed72094e

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voice.ai-Downloader.exe
Size 477KB
Sample260809-r2ccdsszat
SHA256 100dba151efe66c842fde4337857fd3db4568c1e3ee008e412927e67ed72094e
MD5 40ffaea0c96bc8fd1ac022ecf287980b
SHA1 c9ff64fecee39aa1a4f1c930d6b6ad423e1b1c14
SHA512 cc0f2ff6b650644564d7469031c96fcaf93b9dd82318eda244abb65970d2e5697ba27bb0c62e31f4f654cc031ac7f19f0692f444674fd174f9acbc201c8944dd
SSDEEP 3072:ckBGWOsTIJgIDU5A/cNo68pMABlZQ2wpFD0ra42L5GYDxJ0ytta:c1ssjH5Mp2w7g+42LUS6
TLSH
T1E4A46270FF02F12BFBC8D4F811B8AE0EC4AFEC8A77954951421A1695CF39B94B9B4548
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
2984	Voice.ai-Downloader.exe
2984	Voice.ai-Downloader.exe
2984	Voice.ai-Downloader.exe
2984	Voice.ai-Downloader.exe
2984	Voice.ai-Downloader.exe
2984	Voice.ai-Downloader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Voice.ai-Downloader.exe

C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader.exe
"C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

user-event[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BWL9CVZL\user-event[1].json
Size 16B
SHA256 c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
MD5 7363e85fe9edee6f053a4b319588c086
SHA1 a15e2127145548437173fc17f3e980e3f3dee2d0
SHA512 a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85
MD5 SHA1 SHA512

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx2F16.tmp\INetC.dll
Size 21KB
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
TLSH
T158A22B5353A01FFEF3E7153878B27B3745A99A6450938A9F07B32D8D2566282BD32342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx2F16.tmp\System.dll
Size 12KB
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
TLSH
T140425A0583618EF3F5962D3C00667E2F2B79BE3416F140639FE34481A99A1CFA975392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads