Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2023, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll
-
Size
3.6MB
-
MD5
a92d5ac95942035396dda8baead2b5de
-
SHA1
42d657eb9486bd777838e2add24b4cfc1598ba4c
-
SHA256
b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755
-
SHA512
3635355a4d1b564970b7e2038e49126635f6d24ef81ac172871c6220ca5770bd136283a3385366293edb21b45c104529ea6dc2193e392152ab51f05bcb32611e
-
SSDEEP
49152:YjapCJeS7PSQvZkJg7kKKvMg98P+ilzue089HH/f:VpuD6zvMgCPVb06
Score
10/10
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/1800-137-0x0000000016C00000-0x0000000016D4D000-memory.dmp unicorn behavioral2/memory/1468-148-0x0000000000400000-0x000000000053A000-memory.dmp unicorn behavioral2/memory/1468-149-0x0000000000400000-0x000000000053A000-memory.dmp unicorn -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 rundll32.exe 1800 svchost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe 1468 dllhost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1800 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1468 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 5036 4328 rundll32.exe 82 PID 4328 wrote to memory of 5036 4328 rundll32.exe 82 PID 4328 wrote to memory of 5036 4328 rundll32.exe 82 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83 PID 5036 wrote to memory of 1800 5036 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cba8d6da42a2cf40009b50502f7eeeb4ef601f0dafb7c2ee6aa9d4e2629755.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1800 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
-