Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 10:51
General
- Target VanadreamsLauncher.exe
- Size 6.1MB
- Sample261102-mx374aeg75
- SHA256 866b715dbc7954814802b6b5cd8f97ccb86e912745d5ec3873ce6ac0b273a412
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VanadreamsLauncher.exe"C:\Users\Admin\AppData\Local\Temp\VanadreamsLauncher.exe"1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML.bak
the-lanterns-are-lit.mp3
memory/2864-5-0x000002424FC50000-0x000002424FC60000-memory.dmp
memory/2864-10-0x000002426E720000-0x000002426E7DA000-memory.dmp
memory/2864-0-0x000002424DAC0000-0x000002424E0D0000-memory.dmp
memory/2864-6-0x000002424FC50000-0x000002424FC60000-memory.dmp
memory/2864-7-0x000002426A590000-0x000002426A598000-memory.dmp
memory/2864-9-0x000002426A5A0000-0x000002426A5AE000-memory.dmp
memory/2864-8-0x000002426A5E0000-0x000002426A618000-memory.dmp
memory/2864-3-0x000002426A710000-0x000002426AC38000-memory.dmp
memory/2864-11-0x000002426A6B0000-0x000002426A6CC000-memory.dmp
memory/2864-2-0x000002426A010000-0x000002426A1D2000-memory.dmp
memory/2864-1-0x000002424FC50000-0x000002424FC60000-memory.dmp
memory/2864-35-0x000002424FC50000-0x000002424FC60000-memory.dmp
memory/2864-36-0x000002424FC50000-0x000002424FC60000-memory.dmp
memory/2864-37-0x000002426F090000-0x000002426F114000-memory.dmp
memory/2864-38-0x000002424FC50000-0x000002424FC60000-memory.dmp