.�!�ۍ���ZX-+l��a%�]KLH���P�[ z���(e��E��L��o�Ͼ���,�5��<h�̞�o��(�+����P�� ���b�c���G8P*�=�0�S �������S���l���&�W�����< �E�%�2���x�{�kd�m��h��-�i� B�3ыH+�o����v��I�md)���g�{�Ud[ʚWRmX�t2I���4�j�����v�G�p����"�&����xB'|����Y���/�qQ1�� d�E�8Z0M�@Bϵ���xX[[f�F������r�[��ԜcG~����#U� �r���C"�}��x�ft���T��yt4Op�������U #�XH��3�c���{E�Nv��F.~Dl}z����H�%��{� �����������eqn]��a[�oA�F��5B���_�����y�/� kz ����<8vH�J�.'�y����I+Y�����j�h�y������\}�����A��y"�� �;�_����۔�rb�*A�$���;WUG�H�$�@�)*N�̿,�v���I�X�'N��� �{���.�������������Ӗ��_�e�}D���J&�ǔ���'�E$q�3P�k*>9G����� �!��1���m˙����-q3iг�S�� 5��kR-� ������{CV��ƪ�}U�,q���K S ���8�Xjd�����-��7�I�n��E~3%g�=�^�I���,�#�����hl W��j����̌A�e�I�����<S�+4��|wo�8#z��m^��{��5���N���ZS��ޠ7�yo��� cl��#�&la�Ci�g�+٠u��Ct������ �2Fg�� e[u �,���Ri��j��%���O�GQ�������@�jߑϺ�cC�ϊbB��~T6�(�/�G�o������a�*#�13k�$��j`%�`�̸H��u�EƘ��M{D` �E�0�<B�"\�j�5D�eٰ����> ��Q�䢺?Ǵ�wC֏:q��V�u���U�W�|�Ŋm s�r���L?��GD�2�(�kh�~����I�nW��w@ik�[sC&���uك�� �ڇc ��� <P�`� �����v�RD�9�L"Cn+����ԅ ��k5V�������v���v>9\i02dHC�]v�g��^����vɣ�χ�~��gd^=)�]�Ur�]��7��*����F�U����-��g4�n���v-J���� ����Ϩ!��k�,�)�~yE�n���x�iI@�8�.�^���a�!9b�\��wݾ�Z�� ~�^^U�M`�����w����}t���(�mMhuBc���Eْ �t�V���VOs,�z���X�&1�o��<I0x� =ז+�+�!����C�He'�C_��y!e�� O��&^T�f�B���R�������f�f���������I���k�FQ�2�?n96ɛ��M���3���|,�.�D�? �9G�G�V�����u����8xŘg�f� ��˽��� �j�g��E %acYYx 7��r�4�0.�>�i��rq�9�t����+���P�/#�n���=dZ�ɜL^�,�4�zw�;���*��m�zv���d�GO����V�kFj�L|:��`�_�Ҟ|$�]&ޜy���y�J��.�}�%?�Qfy�㳇@������J��r���%s:O�c�jPup��l�p�*�����{��G+��_��D�\���f|�Y���82Q�a˭/ļ�wz�|�d����!D�E�-:�����/�S�g|c)uUͬG�Z_/��z�4�� �Gy�ϑ��k��2����8�ٰI ���5�U�/���LY�#��1�n� v�1���/)F��d�QQ���:Bʽ�ч�N��#��� ?ɏy���{,4��]qGw���3�ێġ����c���D�L�CT���E�6�V��ݐ_�X�嶼�. �;Z0���Y}�H�n�������:J��.���n/��W��`<����z��> I0&1X=гR�����z�_�z+��Hܓ97ʉ��V���E���0�|>�'�K�nI�4X�R�T�'Y���ڽ��`���+�Y�0^�A7~Řo֘t�ʡ72�u�8�+��vRyP.Z�6�Y}�O����g�D˓��g���� � ����"cu��^�|qS���#Ƨx�)����G�P��_���}qa_�_jN����Ў���u��ߺ�X����De������'%1w��#z��@lz7<��l(D�G����0G���p�|7y����e}&?��=� :U�Dou�c���2�Is�q�M[k<i�/�gPꔄ*�.���J�y��Ŋ�t��7����Ht����4�`��?��r������Hӂ�S�}�[��$��v�X��x�h��F�r������,.g���n�<�.�k��U �ᡧ2=�V j�u��ó%?��i7A�� $Pķ~��u��v���(��2J�쁲��T_�og���,b<b(�^}�)q{fk5�9�L��v:au�Շ�㊲ ݇4��n�L��!5���c��BI�U�9 ����5�=�9��'=7��w��l��)oFwd��clU��V@e_�'U�?u�� �b��ڸ�wuw�iʕ�w�U^��G�<��{������@ul�W��Ov���>6�B�^�DF����7�>Q�P1 @�D����%�s��9?�va�[��]̇\�J�lm����B.O&�O����h,�~:�ZeW�� ��|��!�d��-M��n܋uL�������r��N%�9�e�Xr�У�!�������Z��46�q֎�I�Z���.�P�l��ks���$cS ��_�Xs�io�$���Wh��0�U�\g~���IT�Y�h�Dh�˜M��6<����U�O.���o�괵 b�JC+zT�w��*x�g�C�= "��O��m��KA��f�?+5-@#�$9+7�U�*����j=�eruLO��d����<����D息f��84�k�Qw�yb7���{1`��پ����s-Ԓ��hrU����p$��FS�B�j�H�W�
Static task
static1
Behavioral task
behavioral1
Sample
Dream - Private.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dream - Private.exe
Resource
win10v2004-20240802-en
General
-
Target
Dream - Private.exe
-
Size
5.9MB
-
MD5
28b99616958fb9086829bc1e4b950372
-
SHA1
f641cfb573c998d767d91ce4fbd87a61f2147c79
-
SHA256
70b4ddf3f00a4f1583722716f230cf0af318955b79289b8231377a06dee882f2
-
SHA512
cfbc637a28410750e317a251e8cc169691971e90376d51f6767da6b7128ad4f772dde38206f7c32b1007367cf7baafea1b153f42629157d310d783adee13f49c
-
SSDEEP
98304:xj7tV7bFaHxFqhl8aB2YdjBzNpTbXn02LXCLxlXf+G:xjfXFoxF6l8iLdjFrz02LSLxlm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dream - Private.exe
Files
-
Dream - Private.exe.exe windows:6 windows x64 arch:x64
e28e89b8deee089cc0bc8c66108ffb7c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
kernel32
LoadLibraryA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
ole32
CoInitialize
d3d11
D3D11CreateDeviceAndSwapChain
libcurl
curl_easy_setopt
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
xinput1_3
ord2
vcruntime140
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
rename
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 892KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pop0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pop1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ