Overview

overview

8

Static

static

3

dSONIQ_Rea...HA.exe

windows10-2004-x64

8

dSONIQ_Rea...HA.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 10:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dSONIQ_Realphones_2.0.24_MOCHA.exe
  • Size 144.3MB
  • Sample260809-mdck2ay1bs
  • SHA256 c81a1a0045ddb831c30b2c6fb440f3d8afd1d5f47cd858cea9e017e384e82d84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutioninstaller

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 52 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dSONIQ_Realphones_2.0.24_MOCHA.exe
    "C:\Users\Admin\AppData\Local\Temp\dSONIQ_Realphones_2.0.24_MOCHA.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\is-P6G49.tmp\dSONIQ_Realphones_2.0.24_MOCHA.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-P6G49.tmp\dSONIQ_Realphones_2.0.24_MOCHA.tmp" /SL5="$40170,150441637,898560,C:\Users\Admin\AppData\Local\Temp\dSONIQ_Realphones_2.0.24_MOCHA.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\dSONIQ\Realphones\vac\instrmv.cmd" install"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
          • Executes a command shell one-liner
          PID:5932
        • C:\Program Files\dSONIQ\Realphones\wdmdrvmgr\x64\wdmdrvmgr.exe
          ..\wdmdrvmgr\x64\wdmdrvmgr -q -h "Root\{818c4061-a772-4b8b-9673-00129f34e083}\0000" -i "RealphonesSystem-Wide_818c4061-a772-4b8b-9673-00129f34e083" "C:\Program Files\dSONIQ\Realphones\vac\vacdsqkd.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3636
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{28b466a2-f925-2f4d-b82e-2dc8fcd017fc}\vacdsqkd.inf" "9" "4e64326f3" "0000000000000180" "WinSta0\Default" "0000000000000178" "208" "c:\program files\dsoniq\realphones\vac"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:252
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "11" "ROOT\{818C4061-A772-4B8B-9673-00129F34E083}\0000" "C:\Windows\System32\DriverStore\FileRepository\vacdsqkd.inf_amd64_8710325a96463b9f\vacdsqkd.inf" "oem1.inf:a52522ad0c48fa1f:DevInst:4.66.2.12379:realphonessystem-wide_818c4061-a772-4b8b-9673-00129f34e083," "4e64326f3" "0000000000000180" "d1d5"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2708
  • C:\Program Files\dSONIQ\Realphones\Realphones System-Wide.exe
    "C:\Program Files\dSONIQ\Realphones\Realphones System-Wide.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:896
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004DC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Realphones System-Wide.exe
        • Path C:\Program Files\dSONIQ\Realphones\Realphones System-Wide.exe
        • Size 11.3MB
        • SHA256 9d7c6fb7193e33c6e5ae5e0e0675421bbeb47ca69366bce9e619f7da7f70f93b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        instrmv.cmd
        • Path C:\Program Files\dSONIQ\Realphones\vac\instrmv.cmd
        • Size 1KB
        • SHA256 2a99c0fb26b7133d93baea1eb9a436fdbe621155c8b895d5c6e1b473623d6cdf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vacdsqkd.inf
        • Path C:\Program Files\dSONIQ\Realphones\vac\vacdsqkd.inf
        • Size 2KB
        • SHA256 86ad15665607e95a0fe5c762d375ce537b2f8b6e82d32cb3be4c69959a2e8596
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wdmdrvmgr.exe
        • Path C:\Program Files\dSONIQ\Realphones\wdmdrvmgr\x64\wdmdrvmgr.exe
        • Size 24KB
        • SHA256 e1e26880c23a5fb771bff8070dfa092cbf1f173c13c971fc554724d539b89229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dSONIQ_Realphones_2.0.24_MOCHA.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-P6G49.tmp\dSONIQ_Realphones_2.0.24_MOCHA.tmp
        • Size 3.1MB
        • SHA256 9443ad0d4f756a39b7ec6717af3d394fa173c85c33a7431560a5bc91a3fd3220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .Slots_temp4d995db1
        • Path C:\Users\Admin\AppData\Roaming\Realphones\Hall Med.sset\.Slots_temp4d995db1
        • Size 143B
        • SHA256 bc09bb27d316037880b5d40bcd1fcda01151dbcfcebe474f3bee3377df9c0603
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UH64937839f8074e2a84c6ef5551654344.flt
        • Path C:\Users\Admin\AppData\Roaming\Realphones\UserHeadphones\UH64937839f8074e2a84c6ef5551654344.flt
        • Size 816B
        • SHA256 10f8af517b9df9b89d0182e11ddc473ca7dd7c717fe24a9916ed675da5b65505
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Realphones2Core.settings
        • Path C:\Users\Admin\AppData\Roaming\dSONIQ\Realphones\Realphones2Core.settings
        • Size 107B
        • SHA256 762688eee57aadac270fd2cc80821235c294b2825a1145f290397ab456025297
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vacdsqkd.inf_amd64_8710325a96463b9f.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\vacdsqkd.inf_amd64_8710325a96463b9f.ini
        • Size 425B
        • SHA256 b281ca4a39da74e525efbaa8cf507d49f9f3004498cb487e7aa93d8d0fa72eec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vacdsqkd.sys
        • Path \??\c:\PROGRA~1\dsoniq\REALPH~1\vac\x64\vacdsqkd.sys
        • Size 263KB
        • SHA256 f403e00ef99d346e98af8e68bf733b71fa68aff44b8df85975d654dce7007f49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vacdsqkd.cat
        • Path \??\c:\program files\dsoniq\realphones\vac\vacdsqkd.cat
        • Size 12KB
        • SHA256 39f9c87f5e8c124f911d0337d6f12b0f185870ec6140f4725ef0bba983cdf038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/896-71-0x00007FF690FE0000-0x00007FF691BB9000-memory.dmp
        Download

        memory/896-268-0x00007FF690FE0000-0x00007FF691BB9000-memory.dmp
        Download

        memory/2152-1-0x0000000000400000-0x00000000004E9000-memory.dmp
        Download

        memory/2152-67-0x0000000000400000-0x00000000004E9000-memory.dmp
        Download

        memory/2152-8-0x0000000000400000-0x00000000004E9000-memory.dmp
        Download

        memory/4244-65-0x0000000000400000-0x0000000000724000-memory.dmp
        Download

        memory/4244-66-0x0000000000400000-0x0000000000724000-memory.dmp
        Download

        memory/4244-9-0x0000000000400000-0x0000000000724000-memory.dmp
        Download

        memory/4244-10-0x0000000002760000-0x0000000002761000-memory.dmp
        Download

        memory/4244-6-0x0000000002760000-0x0000000002761000-memory.dmp
        Download