��0hל�U���P�r�{ګlLK���R��� {o����ì?�+����� ���F,�w���������3 <�[��� ���2�ͬ���4��dz�֫������l�' m��X����5����k���+��/e<�?B��<��+"�w(��}-W���ᅚ�40U~F��U !JFQ�g��J�V�(�1�B}Z�ƨ���P@��~(��B&d�wD]������7�J������|��0��Q���kD,�`QMV(�Ga*-�|XdbZK)�hT �i��6p��@π�74'h� f"�#V�� �TS/�t�r�9�f%`��SȜ��Pjn�[�'�Y�9 �/ʄ��RM�4�/����$4^j2��5g���Cd������}-r:Sݒ:\��S����Us��,!M_�J���"�,J ��Q23j�M�K�����Y���Z�����K��j������f>���b�ȸ�?��֯F�G��B��KoU)~Ң;\�����c�J#� g�v?Y��4��aD��r�±��7����Sw�ː�7$��$xx�/�%P���`���/��w'�י����� ������4������5���N�:8|��a$��T]�N�@ad�_���t�3>�p�����DɡF}��#0��h���U�n���`���g=�c�n]3���g����3�Y�-��۩Z=')�v���a#� �#�b\+0�����|�d�/�JAwr���r絫���1S��{\q�<*��.ƾ=�4����U� :�5f:D%��a�y�1T2pYywU�vQ`�����SVw�fVi����)�~c�$�G���Ɖϭ���� G,�g�eK[BW[��C;>��+A�0@IX���3���1�+Z�����M3��5�x��"����J$�n�2�eb)�i��L�+PD�����0La��|��=�R;�ˢ�RO��Xv2!���56�U��V���D�cw�&l6�%���R2���N�*zA�eK����k���z����11 ��v5�FM�`h�� � |DMy8^�,LD��F%�㍩��! @q<� Pc��Q���e�)F^�b<�:��d�BmK�?�� J��ݎ�wbZ�QK`�� <�#V�ͯP�Xʛ���˯ё�4g�$E���|����lt�MV�;[ڍ3Ҧ�����9��W`�����'�l��v����2��aҙ\K6���� ���ң�Q}�>�=� �?^����=b�ۘ\�����f��y�����ɹ6ζҴ�C�X�ɺ��eܴ"�{��lH}_N�\���U��?���Y_��]��ͪ��<�1{�o��"�|s �����L�po��Ԗ���B���Eك�w�_�w���֠�:켒 �t�ޛ��K@��Z2~���I=�* ��ޱz~&X73^��v�C�\z�x�b��?�'�m�0{� ��y�ʹj���F�zA����kk�G�S����1^�m, a�h�P/]����r�������ͯ�z�c��9v���hQ�!�*R�*��H�[�G��7کL�t��Y&+YDY��PI���RjDj@�����I�A��Z���n��M���0�V��2������ U�W� ���mv� ��_?M�K4��������%�>��b��>$��^3+4 ����J���`gD��XPVsq���e��n���NJ�o��^w��-|���L����Z��^{ ,�wwQ�a��)^P!�f� ��P��]���q9�S?����A9���y������-o>A��8Z?�u�L����Ez�N� )}�RK�00O��I�������ⴛ�G�/�y3�!���ܩY2�Á��8��y�CH�yv�H��ߧ���%�Ċ���u��@�״�O��|8�!ךt�-�<.钐J��fR�#����hS��b�t͍Fb����/��!�n_�X)�R�7q -vi������F@��Pg&�cj�ÜJy`S�q�xIm#�@�[m�l��~�x��j!˓ eЧ1�"�2�p/*�(!��(OARZ���S>?;-�^���CH'ћ�^�A���e��&+Y�T^�-"��1��DJd�kW ��u�NRu`D��%��H�C�ml�ho��v�4.��Ӛ��(��`��7�R\�*,��P՜���+��L75�*Z������$͛�E���e>n�=�`>~�/�w�vz�a?�<^n��]ȸ.|�j��Ϟ� {���g��/�'U�~�J�����@�qQ�Ȓ)4��&F�"D���>V3Jh�k/�q�0�\PH;A�MR��X�cK�6)���u)ܕ����%�lN��z���Q,��y�5�����Zt~������E^� �k�j���%����`̧1XDZ>ҍ�F�;��\���'m�P�# Kw��p��|b�y]���#�*L�hzI�%-~�!+��0~� �U4%����p��~zCqN��u��g��&���Hb��%����;��ߘ�,�(����@ �yURfx�P�v� N�Z�vM��8# {-k������4��4�Q��);��8����(X r/��r���=�A*P.u3��0g�J���oZz��z;��n�bMR2������E�ᄅ��r���{X,\IրX#�J�w�FRY���I+���P|�Pd��D��Y�}�Z$��[��m�U�?.Z��^����Rѡ����^ѓ�s�@pe�ÛT�y Ul �p8�,)�� �Ă��oo�y'�߀�QK�O������t��{���a���Z����H�0��Z�"$V����״�G��������WB��N����zT�_u�-)/O�4�+��'t�La/0I���#��}���H0;8t¦6"h7�(�_�HUc'�� �MZ���ah6@�Xu/r'݇n9~4O�kЃǣ'^_@i1U^���k���p��͛"|�0���`e�A� +�PV~[G�.vL�ۓ9?����S=}�N��j���[^�'73��X����^�=&����"t"��;�&���^�ݴ����{��-�N�˖fD`�R$~c����r���NpZ�=�gpܯ�Hح���T��mv$
Static task
static1
Behavioral task
behavioral1
Sample
Dream - Temp.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Dream - Temp.exe
Resource
win10v2004-20241007-en
General
-
Target
Dream - Temp.exe
-
Size
5.6MB
-
MD5
2833f7e71afa3dbf90b008c09af10352
-
SHA1
bca8b64634e6cb15b92ccffd791a99ed31b57db1
-
SHA256
5028cd2e942351415e9ef3331dfc7a6838155ce70e09b5c2adaab72047866680
-
SHA512
c8b5b57c253d45094676d1f30c9f8b6c7fea438dea9bc2aa7edefa0c0401152d0ed5976d7f3b27650dc1c68bed7cc644ea19c23a4bc39d3ba159fd5c99c29f8a
-
SSDEEP
98304:yZRDl080ffXETPr0T4VICE+Eo/lI0BIkCt5Huor1AZrFf5z:sl7AoI8EoNGvCf5z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dream - Temp.exe
Files
-
Dream - Temp.exe.exe windows:6 windows x64 arch:x64
ed0a349750d6daacba0a5073d8e1e1e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
VirtualAlloc
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
libcurl
curl_easy_perform
msvcp140
??1_Lockit@std@@QEAA@XZ
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlCaptureContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_name
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 870KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pgs0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pgs1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ