Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dreem/2024...pi.dll
windows7-x64
1Dreem/2024...pi.dll
windows10-2004-x64
1Dreem/CeleryIn.dll
windows7-x64
1Dreem/CeleryIn.dll
windows10-2004-x64
1Dreem/Dreem.exe
windows7-x64
3Dreem/Dreem.exe
windows10-2004-x64
8Dreem/Fast...ox.dll
windows7-x64
1Dreem/Fast...ox.dll
windows10-2004-x64
1Dreem/MasterAPI.dll
windows7-x64
1Dreem/MasterAPI.dll
windows10-2004-x64
1Dreem/Mast...ct.exe
windows7-x64
1Dreem/Mast...ct.exe
windows10-2004-x64
1Dreem/Menu.exe
windows7-x64
3Dreem/Menu.exe
windows10-2004-x64
3Dreem/Scri...ipt.js
windows7-x64
3Dreem/Scri...ipt.js
windows10-2004-x64
3Dreem/Scri...ild.js
windows7-x64
3Dreem/Scri...ild.js
windows10-2004-x64
3Dreem/Scri...oon.js
windows7-x64
3Dreem/Scri...oon.js
windows10-2004-x64
3Dreem/Shaa...in.exe
windows7-x64
7Dreem/Shaa...in.exe
windows10-2004-x64
7Dreem/main.exe
windows7-x64
7Dreem/main.exe
windows10-2004-x64
7Resubmissions
27/08/2024, 13:46
240827-q293zstcrb 827/08/2024, 13:43
240827-q1a79svfjl 727/08/2024, 13:39
240827-qx5byatbkb 7Analysis
-
max time kernel
614s -
max time network
616s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/08/2024, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
Dreem/2024 star of the night Api.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Dreem/2024 star of the night Api.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dreem/CeleryIn.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Dreem/CeleryIn.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Dreem/Dreem.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Dreem/Dreem.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Dreem/FastColoredTextBox.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Dreem/FastColoredTextBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Dreem/MasterAPI.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Dreem/MasterAPI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Dreem/MasterInject.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Dreem/MasterInject.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Dreem/Menu.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Dreem/Menu.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Dreem/Scripts/Blox Fruit Script.js
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Dreem/Scripts/Blox Fruit Script.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Dreem/Scripts/Infinite Yeild.js
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Dreem/Scripts/Infinite Yeild.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Dreem/Scripts/Super Hero Tycoon.js
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Dreem/Scripts/Super Hero Tycoon.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Dreem/Shaakey-idfk12-09d89e6/main.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Dreem/Shaakey-idfk12-09d89e6/main.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Dreem/main.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Dreem/main.exe
Resource
win10v2004-20240802-en
General
-
Target
Dreem/main.exe
-
Size
25.8MB
-
MD5
0c53c08f94dbb456aa4e13c4c1c34f4d
-
SHA1
4ca43734541c32b133cda0e1419ac6818b6014e8
-
SHA256
f5880727c5bdd2668488a58f4539ee45725987d30385813c1640248e2ca90a97
-
SHA512
e866d4362403cce625c99b897180501a6e29f1c805e4140155e53fc1b0b2344ca8bc89c34c941b23f078d20279b871ca730342c55360e5b7893d70786b3faec6
-
SSDEEP
786432:4Rqbpsy5PxzhqHLdOfllSlk2qfGIeAvREZdCYR4Owqnu:44s6P2rQX0k2zI5vqdCo2q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3012 main.exe -
Loads dropped DLL 2 IoCs
pid Process 2716 main.exe 3012 main.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3012 2716 main.exe 31 PID 2716 wrote to memory of 3012 2716 main.exe 31 PID 2716 wrote to memory of 3012 2716 main.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dreem\main.exe"C:\Users\Admin\AppData\Local\Temp\Dreem\main.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\onefile_2716_133692400948102000\main.exeC:\Users\Admin\AppData\Local\Temp\Dreem\main.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD53c388ce47c0d9117d2a50b3fa5ac981d
SHA1038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35