Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 03:47
General
- Target VoicemodSetup_2.6.0.7.exe
- Size 64.4MB
- Sample260820-echrnayhle
- SHA256 7ff3b571ce5e9853333c9a1bda22070755c4ac579b9aa785e56db315e851e32d
Malware Config
Signatures
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- cURL User-Agent 3 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoicemodSetup_2.6.0.7.exe"C:\Users\Admin\AppData\Local\Temp\VoicemodSetup_2.6.0.7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QF0A6.tmp\VoicemodSetup_2.6.0.7.tmp"C:\Users\Admin\AppData\Local\Temp\is-QF0A6.tmp\VoicemodSetup_2.6.0.7.tmp" /SL5="$4018C,66753197,750080,C:\Users\Admin\AppData\Local\Temp\VoicemodSetup_2.6.0.7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -v https://wsw.voicemod.net/api.windows/v2/webutils/getAnonymousId/?initialUuid=332724ed-3c1a-4b0f-bd9b-045e18507ba6 -o C:\Users\Admin\AppData\Local\Temp\is-REURS.tmp\deviceId.txt3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"mp_deviceid\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"332724ed-3c1a-4b0f-bd9b-045e18507ba6\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"False\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\tasklist.exetasklist4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\tasklist.exetasklist4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\"},\"mp_deviceid\": \"9ca98fc4-1b50-43ca-9395-f1d88dae310e\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"332724ed-3c1a-4b0f-bd9b-045e18507ba6\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VoicemodSetup_2.6.0.7.tmp
bg-inner.png
bg-top.png
botva2.dll
buttons.png
deviceId.txt
idp.dll
tasklist_VoicemodDesktop.exe.txt
tasklist_unins000.exe.txt
memory/1200-16-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1200-1-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3428-95-0x0000000004120000-0x0000000004260000-memory.dmp
memory/3428-111-0x0000000004110000-0x000000000411E000-memory.dmp
memory/3428-85-0x0000000004120000-0x0000000004260000-memory.dmp
memory/3428-100-0x0000000004120000-0x0000000004260000-memory.dmp
memory/3428-105-0x0000000004120000-0x0000000004260000-memory.dmp
memory/3428-17-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-90-0x0000000004120000-0x0000000004260000-memory.dmp
memory/3428-18-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3428-6-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3428-108-0x0000000004110000-0x000000000411E000-memory.dmp
memory/3428-107-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-31-0x0000000004110000-0x000000000411E000-memory.dmp
memory/3428-110-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-113-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-116-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-119-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-122-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-125-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-128-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-131-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-134-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-137-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-140-0x0000000000400000-0x0000000000681000-memory.dmp
memory/3428-143-0x0000000000400000-0x0000000000681000-memory.dmp