Analysis
-
max time kernel
76s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
24/04/2024, 21:56
General
-
Target
Dream by Vroom.rar
-
Size
36.5MB
-
MD5
3ede86ac03b7044251133610ff8a3181
-
SHA1
6fdfe86aaf67ecfc55cd220e682eede7415ed323
-
SHA256
455f521559d39f72b162cb5e68e301b8427113e073d2ccbfa956ca20742ab956
-
SHA512
5730247feb3c63c182136198dcf80be46ae0537cb1b2fd9bb95f720e98e30898ebcfb9b49d96989cf5e2a0951529f3a5d5e4d765f145124e927cd4f5788befa8
-
SSDEEP
786432:FHF/z/Er7oy4PeO8uRzRUxLltOSOb2xHF/z/Er7oy4PeO8uRzRUxLltOSObA1T2G:lxsIy4PeNuRzsLlpObwxsIy4PeNuRzsR
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Dream by Vroom.rar"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Dream by Vroom\" -ad -an -ai#7zMap16203:86:7zEvent183721⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\install.bat" "1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\how to use.txt1⤵
-
C:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\client\injector.exe"C:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\client\injector.exe" "C:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\client\Dream.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\client\Dream.exeC:\Users\Admin\Desktop\Dream by Vroom\4.6 (stable, works)\stable release\client\Dream.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.0MB
MD5726f20dbd7ad8911d0e4e3641d6169a8
SHA1ee692681ba0ffbb2671bba80a9fa4a01ff104889
SHA256a5fd61f34eeba9e6a949a11be3b7a736c9c904978261cdd422181b34746d1d8c
SHA512a1d37e5f845d93ae064158471244f472a5c1908cd370605aa9422f2ef4bdc908099ee6697cbd87bb78bcb2dd7f2001b5a705b35da7a9788df39af86f30890126
-
Filesize
38KB
MD5791139bb526c7fc6f35f5a35e366460c
SHA1230e6531462f131779231b7e876323b0d3f3bd03
SHA256c9c174ae7c2ad864c42bdada8543296b6d7d2a828b4986bd6aa477431636a18e
SHA5121c664616f4bc2357d6990760c17ee97f2f3406fba78610f52e000e3ff0ee9061481ab6b80ec0cd9b522fcc4bfad0cfa96fe10f43e6e916e0b72b261540e0dcf8
-
Filesize
240KB
MD562e81336c90cfdb251e512b2bab334a6
SHA1787723dec21657ac129b1d2405a0de1a5a007096
SHA2567e817e11d5c452a56868a78168fce662d07c664ab42c4c2f1de0a7083dc49d2d
SHA512785e5c5de823df54320463e326b2b37686554e3d624474039c50afecc23bc41adbf42d5a69b77d084bcc943af5dc98ab5bc9bc71aebd225a39b44a7791cf8ac5
-
Filesize
42B
MD5ef5a33dec8fa0ed991bf0518eb253d0f
SHA1a4d9c63de2fe6008671cb431391d7203792c5495
SHA256f6d0627765ae09e9cec83bf50f45bb94115d836aabc5d290ca628f13b8a250b9
SHA512f52cc8fa5adb0482783cfb62b50c738ef19b63acee91549f53e2ca238b4ef0def094fc6b72f93a0cb206a4fd632c75257f983a0c26912d84a71fe4be62a78f8c
-
Filesize
18KB
MD523191a296f6c4353e23fddedc3f9c2e6
SHA1c951a2c979697d87ce695aaa6f778a6aacab50ca
SHA256a0e69b5ce4d73d44216a7174b4fd40cdbf20a7b8957ba18245afc78b0e4c11e3
SHA512dd70604f89a1e178557ad9f79cfcfd92bc1d3cd284267c35d1f65291f3f7d6e73ce19c34c8bd536c5b5ce6bb7272ba993178c067c8479cd84902f3db882b8dde
-
Filesize
820B
MD5f3af256f6519fa791bae6b91f6a4aa28
SHA196ef3713e44ec8c8d19107186b6fc3cf8ef583d4
SHA256cafeb25d63c8596e2f905e788d9bbe816d50a6d6303922504dade6d50d966d0a
SHA512e77855a61a0a4c728afdcd968b8ce3599659f6eb59620a456fdeefafd1b92dc1d46dfe49a6873675f08d95e61618fb3b91e6ac7565d2e795526cedb9823c3ce8
-
Filesize
3KB
MD5d16a702e6ac716e00145e856f9c454b6
SHA1164c2ba332090c92d2cf33c3e471f13eb05e24f9
SHA2560beafd68246f952c27d08a594269a224e3fda6b2ffae23efe4204908f92f9467
SHA51243f4525f87d33bcf8480ffa2f3953d8c825a44931b7aaccde00a6a0c22e5e648a9d28a670b7820987597e5c7a9999e0884305119fa901745c6914f08656d84ca
-
Filesize
3KB
MD52036e816642cd94a364b1de50563a63e
SHA1a44424928baf548b1615cc84caca99b213ba0e0b
SHA25612530bf1c5dc27bd7337423e773e40e37c83e8e72487ea9d9317c1491ab4e484
SHA512990311d66d145f0d41f797f8b4ccf9e81140c01637cf9e3c31ed25ad995244c19160ff99aa6bbd3a25c8cdbdfc71012ae446cea9595c274013552bc8ec1b2176
-
Filesize
15KB
MD5aa23b7b4bcf2b8f0e876106bb3de69c6
SHA1106ac454ba4e503e0a1cd15e1275130918049182
SHA256cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
SHA5124b46d59ba6c76e5f30c89a5bb3f96f7a72bd7d60cfcad7d48638059d60ec61a317a40df70bb1cd2f2a477de1bb0c2399c671880c2981779df6af99043043b46c
-
Filesize
15KB
MD5bf28241e67511184c14dbd0ef7d39f91
SHA1c706e0a4122ab727645b744c21667390e8898a4d
SHA2560eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
SHA512087a4904dc848706084f212eca1d5f6653e6fe0a7682da9c808cab8c8c45634033aabc9b5a3ba19ec4bbdf6c2f728ddc059ca93a7442b7e1e84ca48c22f41814
-
Filesize
37KB
MD5a417a2fbcbde91d8c2e33ad66f15f0fd
SHA19f2a629343bcf655b4be3f568d554022455c2e28
SHA2565f7cc2d34d6b55f650278d33952099d377cdc454cbffa6ce5ec61ba38b8e4aed
SHA512330c487213b783d1aa889788bc8418103da244b69f3391c298673e0ee608ad92de604f91bc067a6b7fb19ad35d8399480586f340b0aee0dbfaccf23b33a30085
-
Filesize
229KB
MD5101e7fe3d0d874617454f13a2277a28c
SHA1fb420d7a4e6f763703756d094911dd456049c25a
SHA25655aa829476002de02f18455251b4141e0231e429e33b99ccae2dcaa8225e8e5f
SHA5120f4d13e3e584ff0fcd2139558ec4c4f8e12a3eaf6cab74d53ccf7b973a38f76845fb3e0e58feed3a049b1154517d8186c18b66c6783571166ef458a98c9753ea
-
Filesize
351KB
MD54ffeec8ede96d313645139fea749ca76
SHA13a90ee9afb3c088d30708dc2ff59fc513f7b8867
SHA25660df1e1004a8e34925713f0bfe3bc3f56235b8c23c3f756d4af4eab00830e212
SHA512bbc95c77b6d8426e922674e8e600d4168a3ea610ea226399fd474ea8c2ba029522965a41f08fc8ea6088da83bf07efdd0bc1bc2bdcea9d0c460c9b7510771e4f
-
Filesize
5KB
MD569831e8f961b43c43a84efbfbe4ba785
SHA1d682acf39fd94ab43d6a74c3d07b5fec9ae11fc3
SHA2569f694e2c059f2082adc8e3347fefbe1ad0e7764cbdc7d0e1f704ba255d0b7c8f
SHA5129f5b2279a3ea97384f5c2ec6d2560403075872c6f532c953dad75ac2e3781237604d8d86f061115c16cee2aec886c2ed31bcc2ca842cc0272c17d9a21ca7286d
-
Filesize
186KB
MD5f578602b42de1712895205dbed42a2d6
SHA192508a33867dcacd0013790695c23671e1bbe96c
SHA256d8672024beaefc517e09e1b3d0e922351fafa8a068068541471ff8c83b31788d
SHA512b2e8f21e6e3d3def824a31fe8bbc132bb5daf733b60f107201112280fc2b12af9fd8dab359135fee80cd629c44117407aeae424dd0f39edee2b8e145394bd509
-
Filesize
29KB
MD584fee99d65bed42dad1c43d73f413156
SHA1d106d27e512594e32bca06018b8ddb5ef34a5428
SHA2569aa8ac53e94d7729d288829ac767169886f370f96f258010321a6f21524c8a0a
SHA51246667391a6f0b6fd16b7a7242b2abfcbd6468fd83ed4709f9627a2bb96f2cf379b396ec454c59ec85e7f91778787a55eb33cc88f60ffb1866d37ce686b672f01
-
Filesize
17KB
MD5c5d95e12e69863f8f582e06e8265a7d5
SHA1156124b9b684f675eddd42524a8753bdfea854df
SHA2565714f3c132fa285cf11d93524c7d11bf5ff82b589cf0ef440cbef068c208ea89
SHA5125970c367b03155cc48b6f038734da9b39e6c2733489e96d15b56a6bb28d93c971a80c21a4e7614c032ac53a5e7b5093da0f56dfe0e3fd2ad8b9df1ae88cc921b
-
Filesize
59KB
MD583e2e004882bacd1548a66f096ef782a
SHA11dba9adf5f76c8613c676f584ef26f2af7ea6aea
SHA256c5493346e29d9e75dc54e42328459d1e959bbf4e7ee4874054f5a7e0625852db
SHA512d1b7e0e0592c7c7075da58bd8beb83d236db656187e0c256672d89e008b7921d746693428aabde34ebed86620ae2063a719c51d11a0407fa380355b4493b1c0c
-
Filesize
4KB
MD572c962c8261e8f52b60909d4d456e54b
SHA1f764d22b2ccd20dbbcbf5d983c9c9de3db01aabe
SHA256d59cfd1728a9aca673713a8935b97239da0ae8c08cd294c126f6c0f91db9a43b
SHA5126245705adc1f7ea0b68ee70f9cd407e337f2c3ea01a980511787281a49a38350cb11edb80664f6546eec234891201409af21d392e96fe2eea949ec9b23d1be8f
-
Filesize
5KB
MD52a864e847a1d1e808fbbabcd0d0bf97e
SHA175c3687c872ed0e73aefa0a823592e2548bbf402
SHA25605c2897af0e6fe5043e85b25e0c39c9475034ca960d51f78dfba9e1216e154bb
SHA512838cf56e9f4b641589006d3f93fdb85a029a0918479d712371e7447af337edde5cf38f2ef2fa28c9567d5af9875a327d5697fd2632c91880a209ecb070d89270
-
Filesize
303KB
MD598e2cf2d1d8da5706d42595f50231699
SHA1b4315ad40fab78211ff8b646eacc03a07713a75e
SHA256fbf096646a2afb5a7598e30486ff63794b6e5a855ecc92485864596c90c2b81d
SHA5122adacd563a7881299a87617f7e70b6b07ddebf5b00c3637e80ae5472d375f92034876a3a2ca10793c9fc4776042feb4ba2a535f83f70f8e84461cc39561bd60e
-
Filesize
22KB
MD51d213e2ec81206a63cb83c15f3cdda1a
SHA1c34ba5db52dd284a1d9ce1265fa1b9a4d488bee5
SHA256b2286e2cafa58bd3ca46d96f940270bdc8eefed203a5f433db4ee47bf402b214
SHA512b0154ff9c1473d10a4132b5dedb90ab7db856936070560c02d6e3a9c193038047cdb6cf94013e1f759f9ec82a18b99eda17f31e5bf6d99b51ea9742c1a087702
-
Filesize
25KB
MD50d5dff0db51bcb1715b784366d43598a
SHA10fe992ba7685d6218c854f4dc7f0f97e71ce65f7
SHA256fa8de51f7aad70ab9a7e65829e14038d53dde06cdcc1c19f5b0fcd125f1c734f
SHA51255d0791637b34bd6d8658c8efa767beee9c49b43e481b561975f2d5d006ae1d015e0dcda23b495c50399ff9859a467485dc1650f8c7804d982d157997bade86d
-
Filesize
40KB
MD5d8d45516d8bcc51e2ce42e19e0832ac2
SHA1b8bd2777805fef0f788701eee45058af97a59118
SHA25689f0ee2e3c35e73cf81d8c9e6fe37e9ead31d2411a34bfa382e1089bf28e6698
SHA5121192a47741e8f3c67918c90f527c01dc84a37ffdfdab43afb66a28a3299522a9ab95720d873693017de84bcf420935ced514e144d0e99c753117378293b32124
-
Filesize
61KB
MD5fa9ff6089bb585925034e8202022e012
SHA1854304e3bad1dfbc72eef4bc8b71c16ed73b9034
SHA2569b396200847cdc6b2e7242c00d505859a5da08e180e8a2798022bd196dc026a2
SHA512c262f32ba9d01c8004c6b129ca55b7c2b37f84fb634379410c27d354de81aa08c43e8405a42ebd3a9fbe64b97fa06b8e1de5c570e2b86d785b5c6217abf49fc1
-
Filesize
4KB
MD588e440b1691fc208f639838284a2aabd
SHA1680090f3de66f506f1876e57bbd28b4821887805
SHA2565a16f08626c08925b77efedb695f79f0883742183157c0b91f9e20fd59c8b890
SHA5123b2349d2bb8fead6ecd798121aaf43112736bc1b22adbaaee49a33061016c78a7420c787474869bdc9a082a15d15a521422409941f8bbacd31af98a4e17aaf0b
-
Filesize
8KB
MD58cf8f8ba017f4ba498f30c45a4ef2a1f
SHA15392683e3d1391732f85add998f0453ea788a9e8
SHA256aa4a6eb3729cf24aa7a1b2a26452dbd5cbf322699ef7f4b1dfda1c9c1a583428
SHA512e5774dad5e006387aa67fa052ff4fe273c9f9e2050e437d2d0cd38e4d264fa1fe183dd3b00667844ee14a266e51df6cc323b48b0e509d30c86c36adde8004765
-
Filesize
30KB
MD5ed7b461e84347ecad646c0f35f86973b
SHA1e7e238f4c8699e8dc52925a41f4e6cb5fac28b6a
SHA256330de99569e5d45744b85581164af12ad9d05ef6856e3cc42bab0adad1a2a9a4
SHA512149408ca084915de555e0e224a92f5d9327c8cfef94bda60c902c0ed554c29ab1c3dbd69e5139e686e564fa01d321f305e91042d725a9c388d02d9ccc80b33eb
-
Filesize
29KB
MD5f553e83f85401749caaeab71d3980e2a
SHA1b9c4594ec6d99adffb247c7dd058d20997c34d82
SHA256995e3eba238c3adee249ae9734b500a1f136ef0136b3fe066d529435fc0c4337
SHA512e8599c1ff573c41df1be3d82b540587ac3a1656f0d7ef7f4cda19f444aa7ab28779907dbac4117a05876d81d777b6ec1c37f84791f3da2255b33360bd9a02068
-
Filesize
17KB
MD532bd19b478b8ba76047b23451c20c2c5
SHA1b27de225361c9107b50d3fb59efe467b85498e76
SHA2566ebd4f0f6d1a0f3884ae9c9bdcf7781dd28038bd5f13f1d19e416e415f0f7433
SHA51231ba566e7e0edd1edb0f3e1043b6c3b66eeb43782667e7490ff3569f1bac376c87482f1dcf8dbe144ae4c01c0309534821a703d5e711c121bb2cd616c7ad6bcb
-
Filesize
59KB
MD5175df9b332ac372f44112c8a7ad1d8bd
SHA19e86bdae645c2c33cbca2de118aceb7b62ec2ca4
SHA2562fcc611f417a0f204c3e10e5a537f692fa9fe17827e72523cac57f164f8ef1af
SHA51272f228746de78aaae3c892943b30b4535e181f005a775dbb2d2806eeb0514afe62b44c47169d8b4a677e07ac588fb981a22bc736a6cf08e1b0dab8325ff823fb
-
Filesize
25KB
MD5b49ea1aacfa85ab44515c7af32b9126b
SHA106246d08885a798cce3c1845cae0cbe42193ee92
SHA256e3462ab018bbeb3e59098dd19483f23b09f3c5565d04be429e1a4a0743734ecf
SHA512066bff1e80b80c622c27b67386bbe04c7528dfbfd3ccceda845819fcf1197acc17d620cb220264fd3774962352a9fd099387560dd04ecd9111a8588c6f09ac6c
-
Filesize
235B
MD5a4c03436045d11792e679e837d525eff
SHA1d8209c923d093a3d658a9a28f842137712aeff9a
SHA25638a78640dbd144121363728040738857db24583690ad9784fde1c80ed2a67511
SHA512f41cf3389c028cd9fe263a71fe5bcea509dd7ae3adff761937b3e04e22eec11ae5c883a9a01516bcbf0a78e4e6a75891e1ce18976be51e5c158da293ba36fade
-
Filesize
32B
MD5a4a23826b92965c915fbc19f49204878
SHA1ed0a6b714a28a13b90f74fddcea891e5eee14ff7
SHA2565bb50f5ad2441bb8617f551643857d2d76316c26442be8235ef855cce6a4e9cf
SHA51251eecc8c61da6d9bdc5159093c72cbb556c11d15126fdd1757a57a0bb2b2334ad95470b63e111a5fa2d025505adf74bb0a3e8692b3458dd9cce2d8f9131d9322
-
Filesize
24.8MB
-
Filesize
2.0MB
-
Filesize
24.8MB
-
Filesize
24.8MB
-
Filesize
24.8MB
-
Filesize
24.8MB
-
Filesize
24.8MB
-
Filesize
24.8MB
-
Filesize
24.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
24.8MB
