Overview
overview
7Static
static
3dreamless.zip
windows7-x64
1dreamless.zip
windows10-2004-x64
1Dreamless/...on.ico
windows7-x64
3Dreamless/...on.ico
windows10-2004-x64
3Dreamless/..._1.png
windows7-x64
3Dreamless/..._1.png
windows10-2004-x64
3Dreamless/config.json
windows7-x64
3Dreamless/config.json
windows10-2004-x64
3Dreamless/...ss.exe
windows7-x64
7Dreamless/...ss.exe
windows10-2004-x64
7Launcher.pyc
windows7-x64
3Launcher.pyc
windows10-2004-x64
3Dreamless/...log.gz
windows7-x64
3Dreamless/...log.gz
windows10-2004-x64
72024-04-09-1.log
windows7-x64
12024-04-09-1.log
windows10-2004-x64
1Dreamless/...log.gz
windows7-x64
3Dreamless/...log.gz
windows10-2004-x64
3debug-1.log
windows7-x64
1debug-1.log
windows10-2004-x64
1Dreamless/...ug.log
windows7-x64
1Dreamless/...ug.log
windows10-2004-x64
1Dreamless/...st.log
windows7-x64
1Dreamless/...st.log
windows10-2004-x64
1Resubmissions
08/06/2024, 18:36
240608-w85dzaee2x708/06/2024, 18:34
240608-w73hzsfc66708/06/2024, 18:28
240608-w4d18aed517Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system - submitted
08/06/2024, 18:28
Behavioral task
behavioral1
Sample
dreamless.zip
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
dreamless.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Dreamless/assets/images/icon.ico
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
Dreamless/assets/images/icon.ico
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Dreamless/assets/images/image_1.png
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Dreamless/assets/images/image_1.png
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Dreamless/config.json
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
Dreamless/config.json
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Dreamless/launcher_dreamless.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
Dreamless/launcher_dreamless.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Launcher.pyc
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
Launcher.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Dreamless/logs/2024-04-09-1.log.gz
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Dreamless/logs/2024-04-09-1.log.gz
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2024-04-09-1.log
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
2024-04-09-1.log
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Dreamless/logs/debug-1.log.gz
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Dreamless/logs/debug-1.log.gz
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
debug-1.log
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral20
Sample
debug-1.log
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Dreamless/logs/debug.log
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
Dreamless/logs/debug.log
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Dreamless/logs/latest.log
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral24
Sample
Dreamless/logs/latest.log
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target Dreamless/launcher_dreamless.exe
- Size 32.7MB
- Sample240608-w4d18aed51
- SHA256 85b01e2a66fd7ec0b56f99e392c3ca38e062675aa53367cbd9ab11d84f288fdb
- MD5 37ee9d68ebbdd345b86882dcb483b7c4
- SHA1 1274b6098dccd200ff56333d0919bc6492ce9a8b
- SHA512 dd058451f191498341b7874dde8f9bb79474ed3e88d12eecfecf0d99718472ca048bf545f8c4463fd8233908f4219dad2d04e76f3848ec73d9ec2bf97e3703c3
- SSDEEP 786432:YPuQ/OHzeMKVxzx5cWaUI7d4g2b02W8ee0T5tWEUr:YPuQ/OHzDCd5cWC52A2W3e0lVUr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 1536 launcher_dreamless.exe 1536 launcher_dreamless.exe 1536 launcher_dreamless.exe 1536 launcher_dreamless.exe 1536 launcher_dreamless.exe 1536 launcher_dreamless.exe 1536 launcher_dreamless.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1536 2328 launcher_dreamless.exe 28 PID 2328 wrote to memory of 1536 2328 launcher_dreamless.exe 28 PID 2328 wrote to memory of 1536 2328 launcher_dreamless.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dreamless\launcher_dreamless.exe"C:\Users\Admin\AppData\Local\Temp\Dreamless\launcher_dreamless.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\Dreamless\launcher_dreamless.exe"C:\Users\Admin\AppData\Local\Temp\Dreamless\launcher_dreamless.exe"2⤵
- Loads dropped DLL
PID:1536
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-file-l1-2-0.dll
- Size 12KB
- SHA256 476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
- MD5 49e3260ae3f973608f4d4701eb97eb95
- SHA1 097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
- SHA512 df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653
- SSDEEP 192:WKMWfhW0eWvcuyjS7HnhWgN7a8WhMcy/JdSh+Il+jX01k9z3ARvXdRfn8x:W9WfhWe7HRN7DcMyEjR9zSvn8x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-localization-l1-2-0.dll
- Size 15KB
- SHA256 db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
- MD5 71457fd15de9e0b3ad83b4656cad2870
- SHA1 c9c2caf4f9e87d32a93a52508561b4595617f09f
- SHA512 a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
- SSDEEP 384:WbOMw3zdp3bwjGjue9/0jCRrndbWsWfhWU7HRN7ApUad+JR9zuszu:yOMwBprwjGjue9/0jCRrndbGDVadk9zk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-processthreads-l1-1-1.dll
- Size 13KB
- SHA256 ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
- MD5 e93816c04327730d41224e7a1ba6dc51
- SHA1 3f83b9fc6291146e58afce5b5447cd6d2f32f749
- SHA512 beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
- SSDEEP 192:WKtyDfIe9jWfhWyReWvcuyjS7HnhWgN7a8WhXO/h+Il+jX01k9z3AR/iXiz:WKtyDfIe9jWfhWyR7HRN7Y6EjR9zSqe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-timezone-l1-1-0.dll
- Size 13KB
- SHA256 64b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
- MD5 acf40d5e6799231cf7e4026bad0c50a0
- SHA1 8f0395b7e7d2aac02130f47b23b50d1eab87466b
- SHA512 f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
- SSDEEP 192:W2HtoXeOWfhWteWvcuyjS7HnhWgN7a8WhPh+Il+jX01k9z3ARiXC:WmOWfhWd7HRN7IEjR9zSiS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23282\python311.dll
- Size 5.5MB
- SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
- MD5 1fe47c83669491bf38a949253d7d960f
- SHA1 de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
- SHA512 05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4
- SSDEEP 98304:ZjCxzAISyt+EaudO141ibXHkMLyP59mJ3:ZjCxzAISXElO13L09
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI23282\ucrtbase.dll
- Size 994KB
- SHA256 36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
- MD5 8e7680a8d07c3c4159241d31caaf369c
- SHA1 62fe2d4ae788ee3d19e041d81696555a6262f575
- SHA512 9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
- SSDEEP 24576:hLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+c:VyubJvlhrVETiR+c
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-file-l2-1-0.dll
- Size 12KB
- SHA256 c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
- MD5 7f14fd0436c066a8b40e66386ceb55d0
- SHA1 288c020fb12a4d8c65ed22a364b5eb8f4126a958
- SHA512 d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
- SSDEEP 192:WrVzWfhW5eWvcuyjS7HnhWgN7a8Wh/g26WGaN4NhrJgX01k9z3An9fXPu:WrVzWfhW57HRN7qTN4tgR9zY8
- MD5 SHA1 SHA512 SSDEEP