��� S�����8��<p�����e���0��O�C?`�t>?��N��~t���8����?yq�!f�5 �������t�2rt����K��C�K�מG� '$��\�2ΒT��q�� ⤂Qu��6�h���m3g�J���a�=P��?R&���l���XT��$�|��ap�����@!����`��\��&gu�p|�\�C���6�k�u�R^Z�lcu��(��b�Y�d�9���Н8�g���E%0���sy?��0`з����$��z^q�f�R!��q4��"ŝ�F���8��)Ȣ�q�Q��۸E.��c��c�����62`�P4ݭ��u���qLUzc�Y60�m6zwiP��A���L�_̴۫|�-B*�V*HhvT�%��^��C����> ����yς6��+3w�mB�%5��ʬv�'���U�����o2�:�<Tz�n0��M���`��`�H.�q�����>���f��w�y�����s�C��ߏ���3;e��1³��~�˓�B��gtC� ���?�VI��?x��*�H/��^JCu�Q�;���嶒/������L����'�-�|iz6���W���4���,uĎ����n���/�N�k\JV�� �<�KׁzY"�E~���}�����q߆�u�k�4�d�\;ufZ?���<j���5��TJ`��(�}�t#���<FdC�����v ����vb�n�˖eM3�sj��>�9>����LG,���l �q3�5�k�z�-99k"�������_;]��'*��� ���_���@��?p�b�"�G/�����J�&t��T 1WZ��.=���njb�fDѮa�؉@�,���Y���hʞ�ذ�d&u��d��n��n�GC\2+�GK`�h�P�����@�[���r�S*�G��y�[Vlw*B�G�\��/~�{���AE���֑½E�7��p�o>ױŞ�]��Ok_ÿI�ǹ(����$%�>X��?8.�>�ː?�$g����w��y@�֔O���!���*M����-L4��=�MM���]�@�G���#q�8���o��̃=/f���Ǧ��2XӰ��-B�4��p �H�N�� ciA,9��,��5�5�u���u�������Y�57��@�^ �a�k�W\����"`=����y��&;.�PT�{J `�~]�6Q^�N�n��v]+�&P�(l�s16`��H�f�ݞq���f�9jZ@����:AT��mG�P�J�zg����q&�/�l�i}�� ��jI��]�Ϲ�!�����"(�m�ZM���D1m�wc?Yc���νa� ��fLٿ�+DN�rM�!�N- ���oE�B+�}��`5 kgZ��� ��x1�4���k���F;n�J��. QP[����5'��M^FG��į6+O���c�1���� ��������炖�ayl5��"���j�d��ت0AwmuN+�ꑽ=���'�9�(ع�4���-O��aD���f�>��p>�N2F>L�T4�z9dUv�Z��*�}:�=0fj�±=_�G��ʢYNf� Oh�}����5����!��t�df�?�/��dH8�DIGڴC�U+��-Ӱ��\#��pr M�-�P2DX� �:�3�(BFM�,�嵕�0=��Q�g�?��T�!���!��`��tg�T������y��i�Ae����,I��F��Ų��H�� �����.X1�b���4퉄xԙq�!<BW�M�c�&�Hsю*,���3��� W���� �T� k�sd����؎�� �7Hw\��4�0��s#K�u��ɦ�B:�*��閜8�U&��'� O����Ұr.�+b�\q��ٙ��v O�=/��al�M<��b(q$Y��[?��b�"/�na�6,SC.M�#�W`u�H&c�S7 #�����&" ���R�W����\A,R����L�6��Q�q3�Q��<>�r(|YҎ��<���\���6 X��h!E\s&���0���u3L�*fT��� ��$G�����kxL-_hZR��k��=����8�!g�E0r ���W��arY���Z!�j���kW����ym�"x��SY�(M[! C����٣&1�Q��\�H��8��W$���oC���;K+��%��o&҆�P�T�[����Gu���!fE*��Q,pȷ���I���L��E���&Ï���n����� � ��������@� )dANu�1��]�w���9� )C��������P:���5^s��=���f��Uf��<<��'��4:�@l��?g�Z;'8u��_�<4"(y�nd.o��5Q�6�S��A�s�� �fKb �:G[�DЀF�@..��hW�E� ��A�d��!d��y+����\�讓�P�R+ ���a������KK1[�;�5���j8��I�1^iz���}��YM��ti�^��"�=������dw��<ȣ��+�V��TV���Ţ�b9*�Z��I�� (D��]�P ���V����Z�R�9�:<��tl+������UP��<8L����W0<��ڙ�2'&�cP;���k&4ۀO39�pp�l�`�z�Ӗ�����S�a���b���)Z��Ru��S��{�@I���l/Y�G4�f�3�F�Z��ij�~�U=�b�D�D�$��BQw��)��9��,��d�ݏ��w���G��>L�R(T��R�w"��xz���}w�aޒ��{������-�<>�G#G��V�cb�P�����"7K�P;]k}����6�eo�^�ꖣ(ŔxD�T<>lEW��pH��!���&ꎤ1�ד����K�C�Q��kl�F���E��2�ƕ`�^����� q't���|ۋ�W!�����RWg/8`�8�>r7�k�*э����~k4�R�J����z���]Q���9�ru7D^p���e8����w$t���s�#W}�s��2(N�0�i��!a5�����21�pN�Ķ>�<p�L��,]���Yzz*:[2�9J)t:���
Static task
static1
Behavioral task
behavioral1
Sample
Dream - Temp.exe
Resource
win10v2004-20240802-en
General
-
Target
Dream - Temp.exe
-
Size
5.5MB
-
MD5
ef1e45cdd8115b74234a98df59b314c3
-
SHA1
c525f69db2366e3f34ea3b4030b509439535dd76
-
SHA256
4bca1407d76c24c570935f2c0534bd46078b8a5e66807e2a83973e81a3e6054c
-
SHA512
7edec99362f1cdea21fb64de55925fd306977405924e00b6f8b723c22b5b1cdee33950b89bbdee42ac9dd16766ac3ef6a2e13e58a01b442e575bb7e1b27f3206
-
SSDEEP
98304:19sY3CyDb6wMBAWsaVGqAF2RN6YpqKLYQhHek/mVaj1vOqZY52:xV36GH0NlqKsQoJVaFOqZW2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dream - Temp.exe
Files
-
Dream - Temp.exe.exe windows:6 windows x64 arch:x64
1d9c015f1a729b6bef44f498abbe7944
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
FreeLibrary
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
libcurl
curl_easy_init
msvcp140
??0_Lockit@std@@QEAA@H@Z
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_purecall
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 766KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cat0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cat1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ