Analysis
-
max time kernel
5s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26/12/2023, 00:00
General
-
Target
44dccd1d8b57ee3b5a8c7833f3cb9d72.dll
-
Size
3.6MB
-
MD5
44dccd1d8b57ee3b5a8c7833f3cb9d72
-
SHA1
faec40b6e2f6b452c273b9ff2cb8101e8c554d5e
-
SHA256
06c438f25d9fd9ced6066c62b1e9b6097401304289d3130e6a3af34e417eab49
-
SHA512
b14a8131b47054132f511723d6ffaa5ca7bae9ddf907a0dd624ff3bb116737105806f6819a99433fcb0fbfeee223360e13d05496546e2a0eb947b6aedd8e293b
-
SSDEEP
49152:3tiEM3qSat9+rZufjlxnyqxSgF8CP4rhDTF+2huh:3tT4ZurlL8CP4rh1+gu
Score
10/10
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44dccd1d8b57ee3b5a8c7833f3cb9d72.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44dccd1d8b57ee3b5a8c7833f3cb9d72.dll,#12⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
3.8MB
-
Filesize
40KB
-
Filesize
3.8MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
32KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB