Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 11:15
General
- Target EEtalk-Setup-win-x64.exe
- Size 48.8MB
- Sample260803-nclyraxvhw
- SHA256 5658e12131d20ccc5aef24833d98eb6f532f0be4c29529cc8ec7e9b76c2f3dd3
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 54 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies Control Panel 1 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EEtalk-Setup-win-x64.exe"C:\Users\Admin\AppData\Local\Temp\EEtalk-Setup-win-x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D4UAPR9SJN.tmp\EEtalk-Setup-win-x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-D4UAPR9SJN.tmp\EEtalk-Setup-win-x64.tmp" /SL5="$501BA,49891077,937984,C:\Users\Admin\AppData\Local\Temp\EEtalk-Setup-win-x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\EEtalk\EEtalk.exe"C:\Users\Admin\AppData\Local\Programs\EEtalk\EEtalk.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Modifies registry class
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CommunityToolkit.Mvvm.dll
CoreMessagingXP.dll
EEtalk.deps.json
EEtalk.dll
EEtalk.exe
EEtalk.runtimeconfig.json
MRM.dll
Microsoft.InteractiveExperiences.Projection.dll
Microsoft.Internal.FrameworkUdk.dll
Microsoft.UI.Windowing.Core.dll
Microsoft.UI.Xaml.Phone.dll
Microsoft.UI.Xaml.Resources.19H1.dll
Microsoft.WinUI.dll
Microsoft.Windows.ApplicationModel.Resources.dll
Microsoft.Windows.SDK.NET.dll
Microsoft.WindowsAppRuntime.dll
Microsoft.ui.xaml.dll
System.Collections.Concurrent.dll
System.Collections.dll
System.ComponentModel.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.ObjectModel.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Runtime.InteropServices.dll
System.Runtime.dll
System.Security.Cryptography.dll
System.Threading.dll
WinRT.Runtime.dll
clrjit.dll
coreclr.dll
Microsoft.ui.xaml.dll.mui
hostfxr.dll
hostpolicy.dll
resources.pri
EEtalk-Setup-win-x64.tmp
memory/4584-919-0x0000000000700000-0x0000000000B4F000-memory.dmp
memory/4584-553-0x0000000000700000-0x0000000000B4F000-memory.dmp
memory/4584-19-0x0000000000700000-0x0000000000B4F000-memory.dmp
memory/4584-9-0x0000000000700000-0x0000000000B4F000-memory.dmp
memory/4584-10-0x0000000003210000-0x0000000003211000-memory.dmp
memory/4584-6-0x0000000003210000-0x0000000003211000-memory.dmp
memory/4692-929-0x00007FFE404D0000-0x00007FFE404E0000-memory.dmp
memory/6088-0-0x0000000000A00000-0x0000000000AF3000-memory.dmp
memory/6088-8-0x0000000000A00000-0x0000000000AF3000-memory.dmp
memory/6088-925-0x0000000000A00000-0x0000000000AF3000-memory.dmp