Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 12:18
General
- Target VoiceTyper-Setup.exe
- Size 6.9MB
- Sample260622-pgldfsby9m
- SHA256 a5e853aa75516b70507f7763517c76e8127bbc31bc4436ce89bad6f81439c7d7
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoiceTyper-Setup.exe"C:\Users\Admin\AppData\Local\Temp\VoiceTyper-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\VoiceTyper\app-4.8.3\VoiceTyper.exe"C:\Users\Admin\AppData\Local\VoiceTyper\app-4.8.3\VoiceTyper.exe" --squirrel-install 4.8.33⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\VoiceTyper\app-4.8.3\VoiceTyper.exe"C:\Users\Admin\AppData\Local\VoiceTyper\app-4.8.3\VoiceTyper.exe" --squirrel-firstrun3⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\VoiceTyper\VoiceTyper.exeC:\Users\Admin\AppData\Local\VoiceTyper\VoiceTyper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\VoiceTyper\app-4.8.3\VoiceTyper.exe"C:\Users\Admin\AppData\Local\VoiceTyper\app-4.8.3\VoiceTyper.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RELEASES
Update.exe
VoiceTyper-4.8.3-full.nupkg
background.gif
setupIcon.ico
VoiceTyper.exe
CredentialManagement.dll
NAudio.Core.dll
NAudio.WinMM.dll
Newtonsoft.Json.dll
NuGet.Squirrel.dll
Squirrel.dll
System.Memory.dll
System.Net.Http.dll
System.Text.Json.dll
System.Threading.Tasks.Extensions.dll
System.ValueTuple.dll
VoiceTyper.Common.dll
VoiceTyper.exe
VoiceTyper.exe.config
memory/2576-229-0x00000280F10D0000-0x00000280F10F2000-memory.dmp
memory/2576-238-0x00000280F1D50000-0x00000280F1D58000-memory.dmp
memory/2576-251-0x00000280F6640000-0x00000280F6B68000-memory.dmp
memory/2576-250-0x00000280F2F50000-0x00000280F2F82000-memory.dmp
memory/2576-248-0x00000280F2910000-0x00000280F2944000-memory.dmp
memory/2576-246-0x00000280F1100000-0x00000280F1114000-memory.dmp
memory/2576-242-0x00000280F56D0000-0x00000280F56F6000-memory.dmp
memory/2576-240-0x00000280F1D80000-0x00000280F1D8A000-memory.dmp
memory/2576-237-0x00000280F4D60000-0x00000280F4E00000-memory.dmp
memory/2576-235-0x00000280F0F90000-0x00000280F0F9E000-memory.dmp
memory/2576-231-0x00000280F0F80000-0x00000280F0F88000-memory.dmp
memory/2576-226-0x00000280F0FA0000-0x00000280F0FB6000-memory.dmp
memory/2576-219-0x00000280F1120000-0x00000280F11DA000-memory.dmp
memory/2576-220-0x00000280F0620000-0x00000280F063C000-memory.dmp
memory/2576-224-0x00000280F1BE0000-0x00000280F1C92000-memory.dmp
memory/3244-198-0x0000017E08060000-0x0000017E08072000-memory.dmp
memory/3244-203-0x0000017E09960000-0x0000017E099E2000-memory.dmp
memory/3244-205-0x0000017E096C0000-0x0000017E096E0000-memory.dmp
memory/3244-199-0x0000017E096A0000-0x0000017E096BA000-memory.dmp
memory/3244-201-0x0000017E09710000-0x0000017E09758000-memory.dmp
memory/3244-195-0x0000017E07850000-0x0000017E07A50000-memory.dmp
memory/5844-19-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-13-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-17-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-215-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-16-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-216-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-14-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-223-0x00000000217D0000-0x00000000217DE000-memory.dmp
memory/5844-212-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-196-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-227-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-12-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-190-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-11-0x00000000004A0000-0x0000000000676000-memory.dmp
memory/5844-165-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp
memory/5844-10-0x00007FF9FB6FF000-0x00007FF9FB700000-memory.dmp
memory/5844-222-0x0000000021810000-0x000000002184E000-memory.dmp
memory/5844-189-0x00007FF9FB570000-0x00007FF9FBF14000-memory.dmp