Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dreem/2024...pi.dll
windows7-x64
1Dreem/2024...pi.dll
windows10-2004-x64
1Dreem/CeleryIn.dll
windows7-x64
1Dreem/CeleryIn.dll
windows10-2004-x64
1Dreem/Dreem.exe
windows7-x64
3Dreem/Dreem.exe
windows10-2004-x64
8Dreem/Fast...ox.dll
windows7-x64
1Dreem/Fast...ox.dll
windows10-2004-x64
1Dreem/MasterAPI.dll
windows7-x64
1Dreem/MasterAPI.dll
windows10-2004-x64
1Dreem/Mast...ct.exe
windows7-x64
1Dreem/Mast...ct.exe
windows10-2004-x64
1Dreem/Menu.exe
windows7-x64
3Dreem/Menu.exe
windows10-2004-x64
3Dreem/Scri...ipt.js
windows7-x64
3Dreem/Scri...ipt.js
windows10-2004-x64
3Dreem/Scri...ild.js
windows7-x64
3Dreem/Scri...ild.js
windows10-2004-x64
3Dreem/Scri...oon.js
windows7-x64
3Dreem/Scri...oon.js
windows10-2004-x64
3Dreem/Shaa...in.exe
windows7-x64
7Dreem/Shaa...in.exe
windows10-2004-x64
7Dreem/main.exe
windows7-x64
7Dreem/main.exe
windows10-2004-x64
7Resubmissions
27/08/2024, 13:46
240827-q293zstcrb 827/08/2024, 13:43
240827-q1a79svfjl 727/08/2024, 13:39
240827-qx5byatbkb 7Analysis
-
max time kernel
361s -
max time network
363s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/08/2024, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
Dreem/2024 star of the night Api.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Dreem/2024 star of the night Api.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dreem/CeleryIn.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Dreem/CeleryIn.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Dreem/Dreem.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Dreem/Dreem.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Dreem/FastColoredTextBox.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Dreem/FastColoredTextBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Dreem/MasterAPI.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Dreem/MasterAPI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Dreem/MasterInject.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Dreem/MasterInject.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Dreem/Menu.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Dreem/Menu.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Dreem/Scripts/Blox Fruit Script.js
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Dreem/Scripts/Blox Fruit Script.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Dreem/Scripts/Infinite Yeild.js
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Dreem/Scripts/Infinite Yeild.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Dreem/Scripts/Super Hero Tycoon.js
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Dreem/Scripts/Super Hero Tycoon.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Dreem/Shaakey-idfk12-09d89e6/main.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Dreem/Shaakey-idfk12-09d89e6/main.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Dreem/main.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Dreem/main.exe
Resource
win10v2004-20240802-en
General
-
Target
Dreem/Shaakey-idfk12-09d89e6/main.exe
-
Size
22.3MB
-
MD5
01d47112d18f6fbac82ca624446c4979
-
SHA1
7e9158e9a09995e9381f3e6349bc827f8216910d
-
SHA256
8f793075f2fdd4dc2a4ef27b275c4efd83a5a8ef64295c40dc92b8dbaac71279
-
SHA512
9d8743578c336a13279b6af709ba7e73ed4236ebb0634c9df0c6228b9f164cf73d06898eedd0a9310ef1fb14686b2b893833167f1a4b21db963d07a8ca31c2d4
-
SSDEEP
393216:Wqil0KbTLzUj/TwsIs0DLSPB0MgNb3W7PBuhxJWjSHHax4:mlRze6+PB01lEZoCSHF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1048 main.exe -
Loads dropped DLL 2 IoCs
pid Process 804 main.exe 1048 main.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 804 wrote to memory of 1048 804 main.exe 29 PID 804 wrote to memory of 1048 804 main.exe 29 PID 804 wrote to memory of 1048 804 main.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dreem\Shaakey-idfk12-09d89e6\main.exe"C:\Users\Admin\AppData\Local\Temp\Dreem\Shaakey-idfk12-09d89e6\main.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\onefile_804_133692400906662000\main.exeC:\Users\Admin\AppData\Local\Temp\Dreem\Shaakey-idfk12-09d89e6\main.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3