.s}9���"��Ò)ƻ���/���?������,h5K�]C�G�zFn����PQآ�Ou@�5v��̉�0�~�p���) TB�&�3!�z�v �����j�D���ml��Z���>�������ӿ�;k�@��45�5����V9/Ǥ��5!��a���-a��3ryk��L|v���7e�F��6�"���� ~�N���9��9��g��°��`��|�������J�ԡ%��,�k�h�-xW���&Bq�w郐w�P�qa5�vW8F(�$��59���>pF'��|�$�̵����!i��Z����� Qț�^�GMD�� �����qi��YBT TD ʗ�J��҂������t���O��L�R~�Q#U2>�pΧ�~ ��%#�@@���D �H#��,n���6�}>�/���]���ẖ��ءMZ��4F{�۽nJV�'|D.��J�SZ�T��D��J��0FȺ۫�/�(�^rK�؏�m�b����a��iĔ�2�q,�LJ6�5;[�F˘�[�t|���I�zi��;x8�Sԙѯt��3+��K��T�B�6D���I���}�|�2�%��l,>�]%�k<E�4����%4wӿl]�+P~��Y�u;�=����m����.�0��Z�� mIq�u��`��qn���]{��W�IS��MXFP|�� BB\���v��[� =K�j��p�=ĸF 8�(U9��8�e!E�3�Xl���.�d���c(6�E]?ȀSs]3tA�۟'MР+� �0<G�v�5�d"Ġ]�g��!�������]��V1��9�19�̣F0iR���a��bi��{��ȓ�^'v��Z��5��'��)����l��9�=cˏ���>���dJ�%|YjƶKf�8HW�F��S����t�;ك�ՆT�V�%�ٚ`�~�vx"U�![�f� a���o�5�E�F���r^,h��}�]|Z�=b-xs��o=Ͽ�����huː�O�/>i՚k$#Z�s���<� E��%�!�6l_�Y�cv ��t4/A�g��O0����1r@EK�P�� �m�fF���X�]��X~T�]��n�\��-7�!�Hf-�qVP��GѠ<��.䮔��M�O�9rW��r p��##�U�O5y:7 τ��.L��V:���<&�u����2V�$L��2���.f[���n��G��m�#���y�����EZ�/k��u#r�Bs���COVJv��d��e�y�n�=g��8��5@2�l�A�}�w������{�&Z�b� ���TI&J�'3G ������}�^����m1�A���<-Ig!�\�}� �?�U�>��>��6��f�{!P��l-�~��9K�'~���4z�I��n�S;$<�d��!W����#N�m���on�ÿ1w;.�F�"m����X�0қ���b-A�T��sy;Cx������H�F��RLye�Q��Z����@lw�Lk��8O�Bخ|��p>|�#[�?'ҽ-�x�ݻpb;;���y6�v����W�A��q�o� +o�yu�J:��u��c�n^����Hh~�x�����z�Kn��Q��z$����?�����73"�F�����)g"U��3ʬ_fiINs� ���|�����Q�����:�g_v�w�&���q���:�Hä�K4�)�^v:P%W�mj�#�������Sp�"�G]UOUYjx�3�{M9Jo/��(p:�á�[�3����i(H=ᑤH����T���|%�L7�:��ՙܰ�� �#{�b6<""�5��QS��6�����M�y+ 0�v� ����dCsQ ��Az��R;#�+v@ä܁Q����aƿ���J�<v;�!-үfhz|�,���1�YLM���a�wH�V��gV�x^��O�v~�=О��������̕��f����ND�����}�ۯ�j�ff����[.�A��F�>�{��5S��$C-i��b-���7V��$��6���+/��E�ٕs�& ��׀�q�ਭzi��g�a��~����n�X卉T9u!�e� qO��b ��!q�<�*��8�PH@��֜���η�`�'����_.���^u�m֧Rxf=J���O=F}�\7� �-�\����WA��`���b�����Z~���7��9�\ħ���{�:T��{K����-�r�~�M=;��2��g���L-;��?�'�$~S��E��LF"���2��>�M��t����j���/z̸&��>�l *�zI^�dw�w�ͽ�w�QbOr|4�a}�Ao�̯��O?L��߿;U�QfۑX��Hن�� 1��7�1�;^Ke�.�����$�@������8��i�}���^=�D�5<��zu�J�M�DIN�N�Y�4�O��<'���\��YT�'��]ݯ�p���=��V���҅�|�������f���yNC��:�E8aA��j�!2��B�Q/��BD-*�,�ݲ��]�f2azY9g�!�m��խ�J��ۺ��Z�Y�����$d��5�nr�Yu���Z�C�o<��G�Y7����h � �S|��6�=3d��vBtgR�dlj�"��sq��㏩?h��dꔠ,֏�;��7S;�n�OO�Ո�db��H��r$���ס;��J�e����+WlYeQ���*7ue)%�\MW����u�;�H� ��܀���.[G�6z*p�1!-E�:���E�6�}�,��О�e��b`9�i�HV5c BpC�D��{wn4*��q�c�+6n�<Ki���w�z+�?��PE[�ۜ�?Y8���B� p "{VS'����ZW�g\�;�������J�8�� 2�8�E�l�TeK��9��Θ�kj��7�%Ct��,��䃝�Pȅ���H�u60p6��Uc��xn�/KM|V�������g��9tHe�9㜿�@��ٌj��A(���;������ӝ�l>As|� LjB�3��c��;�+��ml��p�������Ϸ��#�F�8<\�� �K�@���Ke�l�P4��k�Ė|���\O��Ns�!"Bkg�=�� IVT��i���f_-�
Static task
static1
Behavioral task
behavioral1
Sample
PREM_Dreampool.exe
Resource
win10v2004-20230703-en
General
-
Target
PREM_Dreampool.exe
-
Size
7.3MB
-
MD5
1d69b662cf379a2c42849f16283de633
-
SHA1
d59c16ed13d5c901ea2ea24b5f3022d61772b8ad
-
SHA256
9889845d408e51e074dc74603b7369b1bf268727731f87301344f9c11aaf6b7c
-
SHA512
d9d2510b8dea2b9e8919e02e5ce33882541e0656206dd08651cb36f43996bed3cafa108d7cee36c8c5f9bb15e4e0f6a5b08d7b0c69e19e2c053ced39135858cf
-
SSDEEP
196608:IfFLfcAgCPQ7UTDCmK+UuyKe4wPGz16UXJiIg9x/K:MLEALQ7SDCmnU/KeDuzv23/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PREM_Dreampool.exe
Files
-
PREM_Dreampool.exe.exe windows x64
154929055e7ab9956d8c98da87dae2d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtWriteFile
kernel32
GetVolumeInformationW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
pdh
PdhGetFormattedCounterValue
powrprof
CallNtPowerInformation
psapi
GetModuleFileNameExW
advapi32
RegQueryValueExW
shell32
CommandLineToArgvW
ole32
CoInitializeEx
oleaut32
SysAllocString
netapi32
NetUserEnum
secur32
LsaEnumerateLogonSessions
iphlpapi
GetIfTable2
ws2_32
WSASocketW
crypt32
CertDuplicateCertificateContext
bcrypt
BCryptGenRandom
vcruntime140
memmove
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.~u` Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.S^F Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.z\% Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ