hxxps://github[.]com/PenguinLover21/Dream-Grabber

Analysis

max time kernel
840s
max time network
845s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2025, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/PenguinLover21/Dream-Grabber

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4428	msedge.exe
4428	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1412	4428	msedge.exe	81
PID 4428 wrote to memory of 1412	4428	msedge.exe	81
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 1592	4428	msedge.exe	82
PID 4428 wrote to memory of 4960	4428	msedge.exe	83
PID 4428 wrote to memory of 4960	4428	msedge.exe	83
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84
PID 4428 wrote to memory of 3976	4428	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/PenguinLover21/Dream-Grabber
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb51ca3cb8,0x7ffb51ca3cc8,0x7ffb51ca3cd8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,362146945000038606,17058695150515893957,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ae85e5cf3f16b6f88fea75afff52ab0

SHA1
b5e295ed2ddf08be4d80d37a9ecd65c25df6e517

SHA256
d45c4ed2ae15c6079c37164fa5f36c8413ad19234f11bf698f0db413788e78d8

SHA512
3ab8a201e3d426262d40d00a4d9f37c323df95f2edcb3a1a831c081a64825f5cf5cd37e7f9b9ed38eda7e09989f7ba9f5f9146ee49929acd1d61f17058b0c4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
57d5636cf19706fbbd7b4f22dd021e66

SHA1
4f8eade2a567064c8e2f711333f59d0c2f32ace9

SHA256
7ad1541c32bd8190e8e949d9c97a39fc65cb327f7f9f5eb23e5e888a2b94c023

SHA512
b755cc197864b65207dbcf79007ebb652bfee509f7118b03894900d9cb5223e81e82ea5ac943427b34c6272d568e9a3d5f9ee2c69862e09d123e89e3961d4b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
953e2b38991ccd08b508d6f2d30d8037

SHA1
5bb48c61fff78bba6b1484ef0164d6ace5223244

SHA256
248aec2ab326dceda41125b9b9af4445c70fe9973d4da35b0063a3fdb656e30a

SHA512
158a17ac3f5a9b4db6d8736300ca8085396fa476fe3f0815e995aa91adab7be1f5583555ec86c722100a9d5ec66a252f22b4dc1122b83d819af6b07c5e8c1f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
aab27555e7a463caded4f29d822c83b3

SHA1
6cf256241088d23ddfd332efab796f282be1bdb3

SHA256
61ee79248875f3044a61c3fe7df3e6637544b3ad59b124da575ab25921b05b9e

SHA512
0dbb85b5b19dbbe741446c3a83bafb1109c810de1761ff3d15969d3c345b499e26c24dab78c85227e6305f652e1425022dd52fb3909275f69ec776f251bbaec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c09e9fc812ed03db0c12b27a35c4d1f

SHA1
ecd7fcb7e7eee966aa646668c41d8f17075dd3b8

SHA256
d3915aeeea16bc569116be609d71058deef445a82e3f079b1e49f456f0089098

SHA512
688878989dbc5ef0068c6c323eb9433bd0976b97198752788c121e73c32c8ee852bc26c0031752d4ec931e3d95e2b37f216f367b3459deafcc7863e7f00da49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
840e31cdccc87063625149ed2aa7166d

SHA1
3601d574b562fb477da90d0e281ee52bdd2530e2

SHA256
4704e7fee3535de0096239817a4e0d0b826b14ac0012c38da8cc352378267c76

SHA512
7fd99cf9087777437153575a5fbbbfb328c67e402e2227a1c695413fe409b3b96cee510ca03c0069b5fddf9697620d78a58dc8bc76e13de26a20755baf614bbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2c76412c6ece5c7a91b32b493ef3c121

SHA1
c97a6dfc36d384857f6b17e6ff437a99b91bd797

SHA256
f3042d225b38e359627117a346b1fcd15b51a8df0b5688a4e0ac36f61fda8f53

SHA512
3f83574ac729d27ca3b5dd9fa83b5f0989d30bce2c4d649fd41d59540128fa8d2384861f4d2f5e951cb34dcb3e95752e3b80ae26d37341b3987c5e80c1397554

Download Submit