Overview
overview
7Static
static
7DreamMail4...er.exe
windows7-x64
1DreamMail4...er.exe
windows10-2004-x64
1DreamMail4/DM2005.exe
windows7-x64
6DreamMail4/DM2005.exe
windows10-2004-x64
3DreamMail4...rce.gb
windows7-x64
3DreamMail4...rce.gb
windows10-2004-x64
3DreamMail4...rce.pl
windows7-x64
3DreamMail4...rce.pl
windows10-2004-x64
3DreamMail4/Readme.rtf
windows7-x64
4DreamMail4/Readme.rtf
windows10-2004-x64
1DreamMail4...e.html
windows7-x64
1DreamMail4...e.html
windows10-2004-x64
1DreamMail4...c.html
windows7-x64
1DreamMail4...c.html
windows10-2004-x64
1DreamMail4...ed.exe
windows7-x64
1DreamMail4...ed.exe
windows10-2004-x64
1DreamMail4...or.dll
windows7-x64
1DreamMail4...or.dll
windows10-2004-x64
1DreamMail4...ib.dll
windows7-x64
3DreamMail4...ib.dll
windows10-2004-x64
3DreamMail4...ib.dll
windows7-x64
3DreamMail4...ib.dll
windows10-2004-x64
3DreamMail4...pi.dll
windows7-x64
3DreamMail4...pi.dll
windows10-2004-x64
3DreamMail4...er.dll
windows7-x64
3DreamMail4...er.dll
windows10-2004-x64
3DreamMail4...ib.dll
windows7-x64
1DreamMail4...ib.dll
windows10-2004-x64
1DreamMail4...d.html
windows7-x64
1DreamMail4...d.html
windows10-2004-x64
1DreamMail4...In.dll
windows7-x64
1DreamMail4...In.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/02/2024, 18:47
Behavioral task
behavioral1
Sample
DreamMail4/AddIns/WinmailReader.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
DreamMail4/AddIns/WinmailReader.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
DreamMail4/DM2005.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
DreamMail4/DM2005.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
DreamMail4/Language/Resource.gb
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
DreamMail4/Language/Resource.gb
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
DreamMail4/Language/Resource.pl
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
DreamMail4/Language/Resource.pl
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
DreamMail4/Readme.rtf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
DreamMail4/Readme.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
DreamMail4/Rss/ListTree.html
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
DreamMail4/Rss/ListTree.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
DreamMail4/Rss/RssBasic.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
DreamMail4/Rss/RssBasic.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
DreamMail4/Sys/AccessFixed.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
DreamMail4/Sys/AccessFixed.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
DreamMail4/Sys/DbCreator.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
DreamMail4/Sys/DbCreator.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
DreamMail4/Sys/DmLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
DreamMail4/Sys/DmLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
DreamMail4/Sys/DmLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
DreamMail4/Sys/DmLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
DreamMail4/Sys/DmMapi.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
DreamMail4/Sys/DmMapi.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
DreamMail4/Sys/IPSearcher.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral26
Sample
DreamMail4/Sys/IPSearcher.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
DreamMail4/Sys/KsDHTMLEDLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
DreamMail4/Sys/KsDHTMLEDLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
DreamMail4/Sys/NameCard.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
DreamMail4/Sys/NameCard.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
DreamMail4/Sys/OfficeAddIn.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
DreamMail4/Sys/OfficeAddIn.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target DreamMail4/AddIns/WinmailReader.exe
- Size 390KB
- Sample240228-xfbfvsbc98
- SHA256 e6a7e475caf8f95cebc80446760b1122e8985106ab685987a9c869c88ed72d98
- MD5 aafd96b5154bc11c44b53bed7853eaed
- SHA1 35d87e6b49bf90e7304c8dbf2b2c954f206ef272
- SHA512 8c854fa5c1f941ab551c9d7a62e466c6022991765a123b0e76f961ebc882b2f6ff9fbf44168b57e0d23450815862e743dbd714c749a0f58dbf746dfa398609e8
- SSDEEP 12288:47hZ2m0DJGEJz+T4Phy7UF/LP8zh+Myn:4nXEBy7UF/LP8zkP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.dat WinmailReader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1480 WinmailReader.exe 1480 WinmailReader.exe