Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 17:17
General
- Target SonOyuncu Client (1).exe
- Size 13.2MB
- Sample260729-vtvesack4v
- SHA256 824c28f347d012e70742a156a417995e29b9a848c31da9572c1719e818cb9cdc
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SonOyuncu Client (1).exe"C:\Users\Admin\AppData\Local\Temp\SonOyuncu Client (1).exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\.sonoyuncu\sonoyuncuclient.exe"C:\Users\Admin\AppData\Roaming\.sonoyuncu\sonoyuncuclient.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sonoyuncuclient.exe
memory/2824-44-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-22-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-49-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-48-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-47-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-46-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-20-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-39-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-27-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-23-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-45-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-24-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-21-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-40-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-41-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-42-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/2824-43-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/3056-1-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/3056-2-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/3056-19-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/3056-0-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/3056-4-0x0000000140000000-0x0000000141F90000-memory.dmp
memory/3056-3-0x0000000140000000-0x0000000141F90000-memory.dmp