c648e72f2d223792a076026f1532b2545b61bd19bbd3a18c22722b95bfae5cb8

Analysis

user interaction
yes
max time kernel
92s
max time network
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SONIC.exe
Size 47.8MB
Sample260821-ahsrlayanc
SHA256 c648e72f2d223792a076026f1532b2545b61bd19bbd3a18c22722b95bfae5cb8
MD5 c8aac36721c9a3ea8f6d6b538819380d
SHA1 4df0660796ee1b75a67cdd6b6c86a5218db85b61
SHA512 d020a2b7aaccad419a654da4578bc87c283de68945621d788655e5f8be4f144fa1a42b41d84c0948b35c61c4e63f9dbb5801ebb81dc8738408b3b40696cfbeb5
SSDEEP 786432:HEJkv9+LE71mOH45+SV8oidVQEUmZQny8z4hcUscFAdeL8ucyBIH5lAT/8LpLl6:Xv9+Lc31PdeFm+nyC4+UscF5j2AT/C
TLSH
T193B733162AD1397AE60427744D672B272B503C6D83B072FA6F3036BC05B34B79E2674E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5788	Sonic7.exe

Loads dropped DLL 1 IoCs

pid	Process
5788	Sonic7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	SONIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SONIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sonic7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5788	Sonic7.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 5788	5076	SONIC.exe	89

C:\Users\Admin\AppData\Local\Temp\SONIC.exe
"C:\Users\Admin\AppData\Local\Temp\SONIC.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sonic7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sonic7.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sonic7.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sonic7.exe
Size 2.9MB
SHA256 65cc8e7ac3f898d900523b0b68e8f005a953bb4638a0bbfdb952735d0a37c36b
MD5 335a525c0daa4ca479cd1364a0c8e0f9
SHA1 fdeea264187b86c1911c281b39f7e3be50869203
SHA512 d0c5c191283950a77f21a14ee2b2aee2adc4aa12138f1c6005a57385370505a8b5d57965f706006d862bd8ca36c3073898a662481f5465afd5bfbf68e5d3b1e9
SSDEEP 49152:w4DWtHFVjaXZdh87PzVJ9G+mJpMaC6p7dYnNcHhL89MZTV/m:bE0p+9GZC6p5YnNchL89Mb/m
TLSH
T1B2D57D407281D0B1E45161F8AC9AD6EF46267F61872895DFB6D03F1A6B736E01EB33C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.win

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\data.win
Size 40.1MB
SHA256 91d05213b51e31834ba99451fe008f1179f7cbb5b6c00721cfde9838bcba077d
MD5 ea242e6507057461cf45e28c7bc69a91
SHA1 e35e137143865764d2a445595572a6661a335b6f
SHA512 33852ddc44351595cdc82f1d09e235d4357bb96eb53bcec292a65fdadce11429abacf9b9e38fb5039c7a95e532440a020d1ec774cf63bae05287dfe5ece9493f
SSDEEP 786432:hxCUT+TZECatDCCOyfU3M2klPAZfvvd0SXc2hvIMZ3PYuAbMkCmpZpsUtP/HT:FSTDa/LfU3M2jNNXB3P1AIyxtPPT
TLSH
T1F5971203F013E64DC8D959328CA2CE492AA1BD499D8149AB7234FF1E68B3A037DD775D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snd_bgmSelect.ogg

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snd_bgmSelect.ogg
Size 2.1MB
SHA256 d743b3dd9e5bfb20ad3fde405c3797ae5976d249af4884d46f59b7d3416c9dab
MD5 f496aeca4ee288f8612fb00e291bd972
SHA1 7a94542aed22632dda319c9e35cefefd3ebb46a4
SHA512 d4852bcb800459e8f835e9ec0ad041555e1e395ba0bba4494d4b923534e530840719280efee750636e6f8d05785c7a98f67595c3b9f4eedc95498ec7944efb1b
SSDEEP 49152:kFa3IipX5aBPGIV32zikpkQXnA3ZJ4MMf0xmXc3rU7Wzdzzu:kFaYOJqPv2z5kQXnogxfQZ/Y
TLSH
T1DCA533E4FD754C2FD91D1C3BB5B700B0197FD47AE7E81022DDFD4A489822A687A3498A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snd_bgmTitle.ogg

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snd_bgmTitle.ogg
Size 89KB
SHA256 0d62a711e942471b65db28a037d128a8ac1040ba2cbd43f8825ebd81a88a0c70
MD5 c7d95a2e79b9ac17b845ff3978033e80
SHA1 952ec6043750fd068cabc717cc0bfef706827a08
SHA512 00c97f69e704aafb9bbf4356ee1df249245cd230f3e6cc8b4c276696c49290ccc33f1af969f1d9b96f43edceac1d58e4b934f891f392637f048021d26aee2ef4
SSDEEP 1536:KZ4t8d+ISqyWvM769CPmIYGR/rSObnETemBMm6ipnb:XmdVSqyWva69CPRpR/rSNMm66b
TLSH
T17F930296CDAA0BB6C76470F30C59687C35BCC3AEE215524BCA6CC475BC63B1BDC29819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads