�����m���-�?Мf�*����xf�ic������C��*2�x� ��"�銏np~��薒=�����F���a^�i ��v�ya*�!�����5�!�;f���߳��2V��&ޤ��Z�e�O���D��U���/���r��+���mp|��~!>L (UѰ��P����V#�F����jALf�gU�1�x%������ {�w��C_��~�]L�3���̾S�H�_��$۸K��)�}���M�ǭ\!b'AfT�8q�ψf���U� ��u��R��m�Q�FU>q>PhG6���gr�<�m�Bv�>�S��*����G��M�l�$���+ݕMЬ�X��9s�Ļ< Xw2��l؞&�v�Kk �h��s1�)y�M���W�3��5��8yֿw76�+|k���%d]�A��5���q]А}K<ԑ: Ʈ��.~��O TH[C�d ��>���s�W�% ����A�M��Z8d��+��aJ� ��_��Nt��W�e�kQ�յ�� x"e�^s\P=�pjt�E��6$�whP~���l�b_�ˀ� �ͧ�ŵ�1����r8d�h�@ \hB��I�G'G��3��Ц����N��5������Ʃ�?����`���w�=��Pg1|ձe�������x�^f&�LS��潩�����9�Z�:/�<��*��90��ޟ#v ]�����FW������]#�9K4���s�=�&����%Sq���7},��B�)�����N���Q� �� =�ˬ�&�������*��Yf�P����v-ʫ��K�lY�oC1����M�����w+�썩�-����X����٥�(�]�+�jA��.���U`�x���PP���j+���GĚ��\�w ��r2��i-��I��Hګ�i��x�O��\�SG�<�JPX�RV�{�K$�f�v�9��?����np�H<#!���f=�B. ��_��Z��%�[V�2(�h<;�j��$���c��A��9� � �\�%�!k А��+斁2�Q+;Pq\KJ!F��6��Yy��.HͿ-}�^���`��MXԐ�q��j�M�M�6�a�z���D3�6P�=&D\�-��Ɇ��EK�y#*��@e����AV~���U���%�l;/��)��� �B�^�̀B�8�K�Si��?(]�?p�h���#z/�1V�kp�kwP�Bܪy��Ͽ6))P=9�Yo��D�B �l����U�W�B�$ZS9�.PVʘ� \?�]��35@��h��*c�ɫ����JD-TVZ*�թT��!���Jr�Q��ٌ柋�q_�b��4i�t��*���!���Y����,���?^2a���{�*x�������WÓ��eŵ�.�B�?(���LL����k���M��F_Ѣ|Ъh ��P������ml�H ���S<�lW@���4�VK�BN��Pڹ!2��Ud8��wI�b�$��rS��K)� �p��bM�Z���AqH�;� �"e���.�=bR_�,��B7U<`���zq�) d����j%������j��Ļ��#M����QB��-a_\�C^���]BvMҬ��4 ��v�t�c1 �[ �Q����|�p��\c7N<�îҀI�Y�#23x :�v�X�G\0�H�=���4��f��J��u^[�g��Y(�:� Uj$����hP\|aih9�{7��x>ɘ�X|D���'��0h�<�0U�kLE�2a�,���Ʀ�?�62�rS��Ǥr������y�ڊY�*y����FuMD���[#e�\v7H�~�"2��;n8$nbU��F��a�B�"�^�L�������]0 ���X��������%����p&�'Q�.]���R�[�� A�~0I P^K�!�ݦ��Q�]�2�iZU�z����#��\���$�y�%�.�җ�LV�1���#���c�% �+����ܩ�+Ew����h�������*hĬ�����)+'B���,���G/�`��9���qoH=$R&���qe ��ړ�*�H'���İ�v����������$�/�lyH��_=��h��h�0>�Z�}H,Z�+��OđB���� ^I���X ��;Jy[���:�&�QY�I���,D%�v������Q��ʝ��@v��^�p(�[~��c���yr�d�ܡ�Z9�)dE$я�4�{�g���)�L]��Tڱ�ϔѥ�ӒB��;�Y��y/����g�Ӫ���6�]@u�Ҙ�1t��*��[�FEU�ϟ%c��� �A�[b=/��_�������������� ����|6�>��-4BvP!�<��%zf&7E���oُں� Y%Z:~���^�Hj��.�r���㶄@�����x�l#!2M}o;� �v���u�Z0���4&`�'�& ]߾�*RZ_`�/C��2����X�p����yy��CZ�ܧ���_��0���y��!��0䎞P�B9G�Ѓ���b��(B')�v$��ɫ�����tà�3b��ɼ��'<$�5�����7~��xe =߹�5���3����^ր$z���:�cʞY������v���l5���wб3<O4����)+:�]�ݵC�e�ZI|5V�4S��B"��7�m�o�G����?�<�M̴� A;,�����m��ۡ¸j��]�ko�E�U;nW8�0ť��A�u�B���"E���ʪ���)��-���Q��̆>uP(��_�P�U���b��D���Z4QiF�/2���w�(D\R�,J��p�^P0b��Q)%P-���l�C���㨎=MSƏk���l�5�����վO����bU/��{�~���k.�@F��!Gc�.�G�1�4�ii�G�?�]]�1�V�w={b�?APŏ��q�Ҿr`��d u���n�<�u��7�4x����y�+�!�.M%r��m@|�,�AedkAS*�/?�>�j^�0~K%j�=���P<�0pD��csO�o;c+��X�.������- ���|��Ɍ�N- ��F�;�:2kV�nv��z�ᶙKp�c��h����+t�?�X�)���];���S�
Static task
static1
Behavioral task
behavioral1
Sample
Dream - Private.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dream - Private.exe
Resource
win10v2004-20240802-en
General
-
Target
Dream - Private.exe
-
Size
5.9MB
-
MD5
19e1516260f6da6ce1fb5ef2cf7e9a4a
-
SHA1
082c476266b9e9f8d97a490eadc820cc15713a17
-
SHA256
945fe6c9cb3594f4cf6a53a3cc5206f5f0dfb6036ca8c8d1ae788c3b7534259a
-
SHA512
1c8e76bc3f3b74b559fef3513f70be6dbe3266918671a344ea6fccefbaf15f763c2cc3749fce2302f96967762bba9729082fdc08e5a89bba2e416710a794e01c
-
SSDEEP
98304:jdJGMDW6vp7xrqn1+A7+Eepg2tgUxMBbjoYPxsLvZ/lXMt6CJa3oUsPf3eyPVMv6:jdJGMDZq1+mk0cYPxc/l8tUodey9I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dream - Private.exe
Files
-
Dream - Private.exe.exe windows:6 windows x64 arch:x64
e28e89b8deee089cc0bc8c66108ffb7c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
kernel32
LoadLibraryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
ole32
CoInitialize
d3d11
D3D11CreateDeviceAndSwapChain
libcurl
curl_easy_setopt
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
xinput1_3
ord2
vcruntime140
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
rename
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 893KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pop0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pop1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ