Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 01:56
General
- Target ViTalk_0.6.21_x64-setup.exe
- Size 28.3MB
- Sample261113-ccw8yaex2x
- SHA256 d8e537678420eaefe99140be904a8d3ea990b98dfa8576cd241967a0898582a6
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ViTalk_0.6.21_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\ViTalk_0.6.21_x64-setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsx3BC9.tmp\vitalk-stop-processes.ps1" -Mode Stop -MainName "app.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hm4ph3zh.uja.psm1
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
vitalk-stop-processes.ps1
app.exe
index.md.CoPtvBKQ.lean.js
memory/3948-31-0x0000000007500000-0x000000000751A000-memory.dmp
memory/3948-37-0x000000006F7D0000-0x000000006F81C000-memory.dmp
memory/3948-26-0x0000000006190000-0x00000000064EB000-memory.dmp
memory/3948-27-0x0000000006530000-0x000000000654E000-memory.dmp
memory/3948-28-0x00000000065F0000-0x000000000663C000-memory.dmp
memory/3948-22-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/3948-30-0x00000000075A0000-0x0000000007636000-memory.dmp
memory/3948-32-0x0000000007550000-0x0000000007572000-memory.dmp
memory/3948-21-0x0000000005660000-0x0000000005682000-memory.dmp
memory/3948-33-0x0000000007EC0000-0x000000000847A000-memory.dmp
memory/3948-34-0x0000000008B00000-0x000000000917C000-memory.dmp
memory/3948-40-0x00000000079D0000-0x00000000079F0000-memory.dmp
memory/3948-20-0x0000000005850000-0x0000000005E9A000-memory.dmp
memory/3948-23-0x0000000006010000-0x0000000006076000-memory.dmp
memory/3948-41-0x0000000007A30000-0x0000000007AD3000-memory.dmp
memory/3948-36-0x0000000072E30000-0x00000000735EC000-memory.dmp
memory/3948-35-0x00000000079F0000-0x0000000007A26000-memory.dmp
memory/3948-42-0x0000000007B70000-0x0000000007B7A000-memory.dmp
memory/3948-44-0x0000000007D30000-0x0000000007D54000-memory.dmp
memory/3948-45-0x000000006F820000-0x000000006FB7B000-memory.dmp
memory/3948-43-0x0000000007D00000-0x0000000007D2A000-memory.dmp
memory/3948-46-0x0000000072E30000-0x00000000735EC000-memory.dmp
memory/3948-47-0x0000000072E30000-0x00000000735EC000-memory.dmp
memory/3948-49-0x0000000072E30000-0x00000000735EC000-memory.dmp
memory/3948-19-0x0000000072E30000-0x00000000735EC000-memory.dmp
memory/3948-18-0x0000000003030000-0x0000000003066000-memory.dmp
memory/3948-17-0x0000000072E42000-0x0000000072E43000-memory.dmp