Overview

overview

8

Static

static

3

dSONIQ_Rea...HA.exe

windows10-2004-x64

8

dSONIQ_Rea...HA.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 10:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dSONIQ_Realphones_2.0.24_MOCHA.exe
  • Size 144.3MB
  • Sample260809-mdck2ay1bs
  • SHA256 c81a1a0045ddb831c30b2c6fb440f3d8afd1d5f47cd858cea9e017e384e82d84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutioninstaller

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dSONIQ_Realphones_2.0.24_MOCHA.exe
    "C:\Users\Admin\AppData\Local\Temp\dSONIQ_Realphones_2.0.24_MOCHA.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\is-BGRKI.tmp\dSONIQ_Realphones_2.0.24_MOCHA.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BGRKI.tmp\dSONIQ_Realphones_2.0.24_MOCHA.tmp" /SL5="$502E2,150441637,898560,C:\Users\Admin\AppData\Local\Temp\dSONIQ_Realphones_2.0.24_MOCHA.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\dSONIQ\Realphones\vac\instrmv.cmd" install"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
          • Executes a command shell one-liner
          PID:3100
        • C:\Program Files\dSONIQ\Realphones\wdmdrvmgr\x64\wdmdrvmgr.exe
          ..\wdmdrvmgr\x64\wdmdrvmgr -q -h "Root\{818c4061-a772-4b8b-9673-00129f34e083}\0000" -i "RealphonesSystem-Wide_818c4061-a772-4b8b-9673-00129f34e083" "C:\Program Files\dSONIQ\Realphones\vac\vacdsqkd.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2796
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5c4fe1f4-9d8a-114e-848a-138cd123f570}\vacdsqkd.inf" "9" "4e64326f3" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "c:\program files\dsoniq\realphones\vac"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:460
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "11" "ROOT\{818C4061-A772-4B8B-9673-00129F34E083}\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:a52522ad0c48fa1f:DevInst:4.66.2.12379:realphonessystem-wide_818c4061-a772-4b8b-9673-00129f34e083," "4e64326f3" "0000000000000140"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        instrmv.cmd
        • Path C:\Program Files\dSONIQ\Realphones\vac\instrmv.cmd
        • Size 1KB
        • SHA256 2a99c0fb26b7133d93baea1eb9a436fdbe621155c8b895d5c6e1b473623d6cdf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vacdsqkd.inf
        • Path C:\Program Files\dSONIQ\Realphones\vac\vacdsqkd.inf
        • Size 2KB
        • SHA256 86ad15665607e95a0fe5c762d375ce537b2f8b6e82d32cb3be4c69959a2e8596
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wdmdrvmgr.exe
        • Path C:\Program Files\dSONIQ\Realphones\wdmdrvmgr\x64\wdmdrvmgr.exe
        • Size 24KB
        • SHA256 e1e26880c23a5fb771bff8070dfa092cbf1f173c13c971fc554724d539b89229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dSONIQ_Realphones_2.0.24_MOCHA.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-BGRKI.tmp\dSONIQ_Realphones_2.0.24_MOCHA.tmp
        • Size 3.1MB
        • SHA256 9443ad0d4f756a39b7ec6717af3d394fa173c85c33a7431560a5bc91a3fd3220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vacdsqkd.sys
        • Path \??\c:\PROGRA~1\dsoniq\REALPH~1\vac\x64\vacdsqkd.sys
        • Size 263KB
        • SHA256 f403e00ef99d346e98af8e68bf733b71fa68aff44b8df85975d654dce7007f49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vacdsqkd.cat
        • Path \??\c:\program files\dsoniq\realphones\vac\vacdsqkd.cat
        • Size 12KB
        • SHA256 39f9c87f5e8c124f911d0337d6f12b0f185870ec6140f4725ef0bba983cdf038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4648-7-0x0000000000400000-0x00000000004E9000-memory.dmp
        Download

        memory/4648-0-0x0000000000400000-0x00000000004E9000-memory.dmp
        Download

        memory/4648-120-0x0000000000400000-0x00000000004E9000-memory.dmp
        Download

        memory/4756-8-0x0000000000400000-0x0000000000724000-memory.dmp
        Download

        memory/4756-9-0x0000000000D30000-0x0000000000D31000-memory.dmp
        Download

        memory/4756-5-0x0000000000D30000-0x0000000000D31000-memory.dmp
        Download

        memory/4756-65-0x0000000000400000-0x0000000000724000-memory.dmp
        Download

        memory/4756-119-0x0000000000400000-0x0000000000724000-memory.dmp
        Download