Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2022, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll
-
Size
3.4MB
-
MD5
32630019e867d0b4dde3acfc63b6be4f
-
SHA1
f0616875f463ed291746cd8d8aab764620b5f490
-
SHA256
61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4
-
SHA512
53f502f2df987f0e0ace5260bfa2e554b88bb304c598ffa925b4c5ba1521912697965e5e0b425e09f37bf1aa919e86637d141114f1a54bfbb80efd9cf1886594
-
SSDEEP
49152:s3974/ASayWOGB41+t3CN0rp5nPYThpCfV:841+t3Cqrp5PE8fV
Score
10/10
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/4388-138-0x0000000016C30000-0x0000000016D75000-memory.dmp unicorn behavioral2/memory/1936-150-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral2/memory/1936-151-0x0000000000400000-0x0000000000532000-memory.dmp unicorn -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3796 rundll32.exe 4388 svchost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe 1936 dllhost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4388 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3796 rundll32.exe 1936 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 3796 4512 rundll32.exe 79 PID 4512 wrote to memory of 3796 4512 rundll32.exe 79 PID 4512 wrote to memory of 3796 4512 rundll32.exe 79 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80 PID 3796 wrote to memory of 4388 3796 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61b9898838e4963292006d0a1e1719dbf164c83071f0af412140eb8273f5e0d4.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4388 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
-