7e1c3dcffb185feb832f89d6f55b23a39abb83adcb56728a46f4785aeb9eed71

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dream Basic/client/Dream.exe
Size

11.0MB
MD5

726f20dbd7ad8911d0e4e3641d6169a8
SHA1

ee692681ba0ffbb2671bba80a9fa4a01ff104889
SHA256

a5fd61f34eeba9e6a949a11be3b7a736c9c904978261cdd422181b34746d1d8c
SHA512

a1d37e5f845d93ae064158471244f472a5c1908cd370605aa9422f2ef4bdc908099ee6697cbd87bb78bcb2dd7f2001b5a705b35da7a9788df39af86f30890126
SSDEEP

196608:0uCcEILkwmDkQ4aDPWMac1CGuEEyG2hnDpdM8Bs1pXjZpo8pHDdCwJ6wuQ:0uCZCyk4fd1luKnDpRMtoUj3JzuQ

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Dream.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Dream.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Dream.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Dream.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Dream.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Dream.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1320-0-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-3-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-2-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-5-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-7-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-8-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-4-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-6-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida
behavioral1/memory/1320-11-0x000000013F320000-0x0000000140BF2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Dream.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Dream.exe
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

Dream.exe

pid process

1320 Dream.exe
1320 Dream.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Dream.exe

pid process

1320 Dream.exe
1320 Dream.exe
1320 Dream.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Dream.exe

pid	process
1320	Dream.exe
1320	Dream.exe

pid	process
1320	Dream.exe
1320	Dream.exe
1320	Dream.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

Dream.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1320	Dream.exe
Token: SeSecurityPrivilege	1320	Dream.exe
Token: SeTakeOwnershipPrivilege	1320	Dream.exe
Token: SeLoadDriverPrivilege	1320	Dream.exe
Token: SeSystemProfilePrivilege	1320	Dream.exe
Token: SeSystemtimePrivilege	1320	Dream.exe
Token: SeProfSingleProcessPrivilege	1320	Dream.exe
Token: SeIncBasePriorityPrivilege	1320	Dream.exe
Token: SeCreatePagefilePrivilege	1320	Dream.exe
Token: SeBackupPrivilege	1320	Dream.exe
Token: SeRestorePrivilege	1320	Dream.exe
Token: SeShutdownPrivilege	1320	Dream.exe
Token: SeDebugPrivilege	1320	Dream.exe
Token: SeSystemEnvironmentPrivilege	1320	Dream.exe
Token: SeChangeNotifyPrivilege	1320	Dream.exe
Token: SeRemoteShutdownPrivilege	1320	Dream.exe
Token: SeUndockPrivilege	1320	Dream.exe
Token: SeManageVolumePrivilege	1320	Dream.exe
Token: SeImpersonatePrivilege	1320	Dream.exe
Token: SeCreateGlobalPrivilege	1320	Dream.exe
Token: 33	1320	Dream.exe
Token: 34	1320	Dream.exe
Token: 35	1320	Dream.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Dream.exe

pid process

1320 Dream.exe

pid	process
1320	Dream.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Dream.exe

description	pid	process	target process
PID 1320 wrote to memory of 2892	1320	Dream.exe	WerFault.exe
PID 1320 wrote to memory of 2892	1320	Dream.exe	WerFault.exe
PID 1320 wrote to memory of 2892	1320	Dream.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Dream Basic\client\Dream.exe
"C:\Users\Admin\AppData\Local\Temp\Dream Basic\client\Dream.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1320 -s 296
  2⤵
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-0-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-1-0x0000000077970000-0x0000000077972000-memory.dmp

Filesize
8KB

Download
memory/1320-3-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-2-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-5-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-7-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-8-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-4-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-6-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-10-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download
memory/1320-9-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download
memory/1320-11-0x000000013F320000-0x0000000140BF2000-memory.dmp

Filesize
24.8MB

Download
memory/1320-13-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download