Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/01/2023, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll
-
Size
3.6MB
-
MD5
a92d5ac95942035396dda8baead2b5de
-
SHA1
42d657eb9486bd777838e2add24b4cfc1598ba4c
-
SHA256
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755
-
SHA512
3635355a4d1b564970b7e2038e49126635f6d24ef81ac172871c6220ca5770bd136283a3385366293edb21b45c104529ea6dc2193e392152ab51f05bcb32611e
-
SSDEEP
49152:YjapCJeS7PSQvZkJg7kKKvMg98P+ilzue089HH/f:VpuD6zvMgCPVb06
Score
10/10
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 3 IoCs
resource yara_rule behavioral1/memory/1964-62-0x0000000015D90000-0x0000000015EDD000-memory.dmp unicorn behavioral1/memory/1388-73-0x0000000000400000-0x000000000053A000-memory.dmp unicorn behavioral1/memory/1388-74-0x0000000000400000-0x000000000053A000-memory.dmp unicorn -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1764 rundll32.exe 1964 svchost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1964 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1388 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 2016 wrote to memory of 1764 2016 rundll32.exe 27 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1764 wrote to memory of 1964 1764 rundll32.exe 28 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29 PID 1964 wrote to memory of 1388 1964 svchost.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1388
-
-
-