172f6c873b246e71c6ecf1c0fffb57ca96bc93b7c55046433b4218f514eddf29

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dreamspoofer/resources/dreamCleaner.exe
Size 224KB
Sample261102-28lvhszy3p
SHA256 172f6c873b246e71c6ecf1c0fffb57ca96bc93b7c55046433b4218f514eddf29
MD5 1c55c014e426a853488ceb2b9e3e1e4c
SHA1 e818495d167286154a36dab6e98c7c7a434bc6c1
SHA512 b9534a16f231d94ccde98ee7515e1f647a1672fd17adee49c1dd79370c06ce7710edaa87262c06c409c8cad0c14e9cf54f7dddaf18ebbc860fbfdf2b38657ed3
SSDEEP 6144:rt5hBPi0BW69hd1MMdxPe9N9uA069TB2ayKcDtbqGN8P1erIjECij:rtzww69TQayKcRbqs89eztj
TLSH
T18E249D57B2A01188EBF581F6D9920746E73074321725A3DB277852B71B2B8CA9F3D3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3092	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2300	cmd.exe

Kills process with taskkill 19 IoCs

defense_evasion

pid	Process
3904	taskkill.exe
2268	taskkill.exe
920	taskkill.exe
52	taskkill.exe
2484	taskkill.exe
6080	taskkill.exe
1972	taskkill.exe
4976	taskkill.exe
2448	taskkill.exe
5472	taskkill.exe
1928	taskkill.exe
4112	taskkill.exe
3048	taskkill.exe
5468	taskkill.exe
5588	taskkill.exe
1524	taskkill.exe
1424	taskkill.exe
4600	taskkill.exe
4916	taskkill.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	5472	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	52	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	6080	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2300	4144	dreamCleaner.exe	89
PID 2300 wrote to memory of 4268	2300	cmd.exe	91
PID 2300 wrote to memory of 2448	2300	cmd.exe	92
PID 2300 wrote to memory of 2268	2300	cmd.exe	94
PID 2300 wrote to memory of 5472	2300	cmd.exe	95
PID 2300 wrote to memory of 1524	2300	cmd.exe	96
PID 2300 wrote to memory of 1928	2300	cmd.exe	97
PID 2300 wrote to memory of 4112	2300	cmd.exe	98
PID 2300 wrote to memory of 3048	2300	cmd.exe	99
PID 2300 wrote to memory of 52	2300	cmd.exe	100
PID 2300 wrote to memory of 2484	2300	cmd.exe	101
PID 2300 wrote to memory of 6080	2300	cmd.exe	102
PID 2300 wrote to memory of 5468	2300	cmd.exe	103
PID 2300 wrote to memory of 1972	2300	cmd.exe	104
PID 2300 wrote to memory of 1424	2300	cmd.exe	105
PID 2300 wrote to memory of 4976	2300	cmd.exe	106
PID 2300 wrote to memory of 4600	2300	cmd.exe	107
PID 2300 wrote to memory of 4916	2300	cmd.exe	108
PID 2300 wrote to memory of 3904	2300	cmd.exe	109
PID 2300 wrote to memory of 5588	2300	cmd.exe	110
PID 2300 wrote to memory of 920	2300	cmd.exe	111
PID 2300 wrote to memory of 3092	2300	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\dreamspoofer\resources\dreamCleaner.exe
"C:\Users\Admin\AppData\Local\Temp\dreamspoofer\resources\dreamCleaner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2764.tmp\2765.tmp\2766.bat C:\Users\Admin\AppData\Local\Temp\dreamspoofer\resources\dreamCleaner.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:52
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im smartscreen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im smartscreen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Agent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Client.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\system32\sc.exe
    Sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

2766.bat

Path C:\Users\Admin\AppData\Local\Temp\2764.tmp\2765.tmp\2766.bat
Size 104KB
SHA256 bae4759483da860870bfcf32fbf9995bd92096f29c4f8507836a3038d8b2fd7f
MD5 cbe07887333a77b4b80e15b4421ec6f1
SHA1 3133524201bac56e92d276d5430aaa6ccaaab084
SHA512 5c76ef45fbfa7e5af8a73e85b0f4541b43fa0d0c9b106581cccedca1dbdbc7a6e6234eaf4a4373c5fe70edb2948b0180347b78a623e8e1947c37e040fa6f8c5c
SSDEEP 768:X/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJ6:vg8gU61nvplxL5LvLpLjLwY
TLSH
T126A3E392621895B2D96704CC83EF864D3C7CE0CA25F5376242F2BA4CD94A83C567ADF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download