?�.l��>"n�}�_e�+R���9Lb��?��Ѱ����HIv}�54��J�$A��/X!֧��R� �a����=�� ��]1&���-�x��OhD��$��`�b /ƕ�}��<�����1e{��Q��bY �)u�����r�f�K�m�W ���R�_�曾H����|{�ɂ�I/���ߪyg�X5���t���`���t�r�yZ�8���c�V��MM|O����nS�u�F���?��je����4���^�$�$[# �ff���� ����D,v�<V�GI���:$!�jȊ��=���(Q���:���h1��)������HewAU�"����4f��p;�/���nwq��,� V����3�����Q7�]�VP��͎@qwM*#'�HlS�]$d����A�� �t.���ե�=�J�UD+�ْmɹ%�\C�P�x8*Ru�e�\:+��6�^J���B���/3A�Z�y���7���d��r��$H���:�c}7�cu%��:���Ѣ≠� i�����,V?��;L����)�y�k�E�ѭd��&2�D������6��1�K���,7MN/~"&.����6H�pqe��w�U�����$*��=��y����b/'�f� g�X�v^L�3i�SC�A��/�y�mbV\N��������DRʵ �Qd�ҍ��� �k��$��vJ����1ż���Y�K�Yi��c '',*���wC��̗����A�K��R���9���p�4�*r�X"~ܑ���x�U�^�>K��u2��'lC��ߡ��^z�����fO.��r��7���Ÿ�ɾ}���URB��`ox�ѓ .�:� �b�o���~��_��o�X?Q���b �cF���&������wy"ڢ�+��8������I[�}nSCdB�tY�X&����J�َ�3���k[@�@�rPv̎n�\8=vlzP���C6���2�~d���"c����m��&�˪I~�ҍ�t�i�!�;'��J��PzG�`VJk�3���U'�S1����1�D =~>� ��&�`8A.T?�k4�#H�߉WG�ԭ�������F�i`-��`&%���ޞ"Q@@RB�Ȅx�xQh�8��6�5���L=���ua�<"�q:�����n^�թ_������VF����Xļ�9���P��Ws�Z��uԱ�/n.�FA0P�J%Nt�@V���*8 u��7Lk�}�'e��x-�C�tq"O;O��3��2�����HGl H��}0�R����e�z(���z��fɳm{��H�'?�_���,Q#��W��7��7m���X�@f����͒�q�7��.���=�$0D�>�A�熛���� ��E���"���+��H�]�����i7���Y����i˭�>M��0L-��)��"��u��f����3�9�9t��jͦea�������:��)A��5��}2:W�ksG}*�g�.�t���FS���ϑMő�Ҥ��kH��.�d���m��U(r�m��jՎw�9:��m�m�c���b�s^{��5�z�GP�{H���?1���%ر�Q�S~{ztڹ7:���Bٸ�� 9O�~�-Ӧ�7���O;��3d��M%$c3��e���b��(�Ѓ=v���g�u�%�Lu%��������k\�u<V��~�ǝ&U ��d�B��OB�3��2#ӈ�{��Kf�������)�f��^_�<bv�����%��K��k�ҁ<ϻmzu���_�e�K�)� =^�t/�6�F����l�D�`Hf����#LY�M��ܔ�G�I�C�r�2�iF�F���K^]�6��\��,�u4�{������=��Y;����Re;Q2�J���M�9,�?H�M���t0��� xh2-Y���.����ǵ�|�`���'���G��TJ�l'� �ގ��D�� �=y-%TR���r��QxkgLd��J@���&��c�R��=��hLo�V���pު����\FŮH|0vP�:��B���~��q!/.v;�{k�ɧS]�Gp�?�Q��D�JW���9ڑRhC4���)O�w��������6�Y8k�kU���0�@NX������w����&�H���^��|Qc�Qg)6:z�gy���������m)UV�L��L��O�2�7��?C�b�e��S��X7��g�Q&����sǸ�K+^��ݞt�e1[.�9�Q�"ކ���`м�jD��ΖV�L�7��F}�ޟF�<t=�g��J�F�^_�ȱ�'�D;�i���Fx��Ό�\����o�~��u!���s~=ܰ�:{�'�AR?��)�����]��.)�̴ ���暢�0Y28}ա'�!�%�ͤ�tȍ��:���dR</��?Qڊ��]�t�8|B�)��*�����X-X�0U��²2`�+z��ٜ�f�[:��H�����C�f)Me������q Ѣh�8 �lE���?� �-���R�e<�q���/�$7ozj*��&�~��o/���K/o�c>�Zڐ�6�{~t8,j;Ǻ�}���9{�0���w��s,(��s�ᚯ�U�!;u����\{'�d��F�v���'��;^�)���z�fPt�Rj�&�Eo`�A��dU�I*�V-;凓Z�7Ǿ��>l৪|7�[��b\M;T))ԝ-&`�K;���K�,��c�Y`y��!Z���S�G�L�� �2�2 8m��AE]w�1/[�^|N�^X�Ɖ\��O1-c`䠟�bg��ംj�PW��c2�l@�vt4~v�H�S�����؉k�l�EDž���N��.'#��F�?���G� ��w �1����sv?�i�U�g���M-����C5B�gC��\��Z����h�c�������e�,{���rX2W�]T`�@��߉ Bf�����K�W��4� �n�Y���ƲI�/�]�-�,��|=s^۽)J�Q��=�i�DCc����2�h�j\��y��:�xs�٣F��Y ��F�ɷ��W�����F;���t�o�6y?�
Static task
static1
Behavioral task
behavioral1
Sample
Dream - Private.exe
Resource
win10v2004-20240802-en
General
-
Target
Dream - Private.exe
-
Size
6.0MB
-
MD5
8e28805017110faa33bfc76475071274
-
SHA1
287158c05f97f122a654f10abe5e3f76b2dd8364
-
SHA256
0e1e62795d4e611052d6266777b3a55dd4f34d9d4a29b5a03734bbc4a92d276e
-
SHA512
be5200957535bddd1f085c7d1c7620ca0719dcaee734be9be6b38e234d0e683910cdc1696b127159e4db3d914b780a04802e90e32423f3ad8046f496347e6c6e
-
SSDEEP
98304:Wr5wuT0zfWb6oe1sBWIkc4lJRKId/NWMFYsJqWyDp6O6QsTtXkx/vNaA:CY46/3IpORR/EMnoUR950x3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dream - Private.exe
Files
-
Dream - Private.exe.exe windows:6 windows x64 arch:x64
63332de7ae9dbe014e7f7e96408fa5e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
kernel32
LoadLibraryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
ole32
CoCreateInstance
d3d11
D3D11CreateDeviceAndSwapChain
libcurl
curl_slist_append
msvcp140
??0_Lockit@std@@QEAA@H@Z
imm32
ImmGetContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
xinput1_3
ord2
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
rename
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 843KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 447KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zen0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zen1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ