Analysis
- user interaction
yes - max time kernel
22s - max time network
25s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 03:47
General
- Target VoicemodSetup_2.6.0.7.exe
- Size 64.4MB
- Sample260820-echrnayhle
- SHA256 7ff3b571ce5e9853333c9a1bda22070755c4ac579b9aa785e56db315e851e32d
Malware Config
Signatures
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoicemodSetup_2.6.0.7.exe"C:\Users\Admin\AppData\Local\Temp\VoicemodSetup_2.6.0.7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NJFTD.tmp\VoicemodSetup_2.6.0.7.tmp"C:\Users\Admin\AppData\Local\Temp\is-NJFTD.tmp\VoicemodSetup_2.6.0.7.tmp" /SL5="$5020C,66753197,750080,C:\Users\Admin\AppData\Local\Temp\VoicemodSetup_2.6.0.7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -v https://wsw.voicemod.net/api.windows/v2/webutils/getAnonymousId/?initialUuid=9671c590-9ebe-4ed2-8bc3-c4b57224adce -o C:\Users\Admin\AppData\Local\Temp\is-F2TSS.tmp\deviceId.txt3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"mp_deviceid\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"False\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"mp_deviceid\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"9671c590-9ebe-4ed2-8bc3-c4b57224adce\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bg-inner.png
bg-top.png
botva2.dll
buttons.png
deviceId.txt
idp.dll
VoicemodSetup_2.6.0.7.tmp
tasklist_VoicemodDesktop.exe.txt
tasklist_unins000.exe.txt
memory/1732-84-0x0000000003730000-0x0000000003870000-memory.dmp
memory/1732-15-0x0000000000860000-0x0000000000861000-memory.dmp
memory/1732-30-0x0000000003720000-0x000000000372E000-memory.dmp
memory/1732-14-0x0000000000400000-0x0000000000681000-memory.dmp
memory/1732-5-0x0000000000860000-0x0000000000861000-memory.dmp
memory/1732-94-0x0000000003730000-0x0000000003870000-memory.dmp
memory/1732-104-0x0000000003730000-0x0000000003870000-memory.dmp
memory/1732-99-0x0000000003730000-0x0000000003870000-memory.dmp
memory/1732-89-0x0000000003730000-0x0000000003870000-memory.dmp
memory/1732-107-0x0000000003720000-0x000000000372E000-memory.dmp
memory/1732-106-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3224-13-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3224-0-0x0000000000400000-0x00000000004C5000-memory.dmp