Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll
-
Size
3.4MB
-
MD5
32630019e867d0b4dde3acfc63b6be4f
-
SHA1
f0616875f463ed291746cd8d8aab764620b5f490
-
SHA256
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4
-
SHA512
53f502f2df987f0e0ace5260bfa2e554b88bb304c598ffa925b4c5ba1521912697965e5e0b425e09f37bf1aa919e86637d141114f1a54bfbb80efd9cf1886594
-
SSDEEP
49152:s3974/ASayWOGB41+t3CN0rp5nPYThpCfV:841+t3Cqrp5PE8fV
Score
10/10
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 3 IoCs
resource yara_rule behavioral1/memory/1348-61-0x0000000015D80000-0x0000000015EC5000-memory.dmp unicorn behavioral1/memory/952-73-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/952-74-0x0000000000400000-0x0000000000532000-memory.dmp unicorn -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1852 rundll32.exe 1348 svchost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe 952 dllhost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1348 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1852 rundll32.exe 952 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1424 wrote to memory of 1852 1424 rundll32.exe 26 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1852 wrote to memory of 1348 1852 rundll32.exe 27 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28 PID 1348 wrote to memory of 952 1348 svchost.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952
-
-
-