unicornstealer | d2b742ff313216772dc0826958eb7e89a0df8d2e12180b8dc2cc77224c65dc45

Analysis

max time kernel
150s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bbfc3ef12abbded0f521cb79cd183d.dll
Size

7.1MB
MD5

00bbfc3ef12abbded0f521cb79cd183d
SHA1

2a969d91fb205c6e3b777cfc4a18dc4e4b3fb214
SHA256

d2b742ff313216772dc0826958eb7e89a0df8d2e12180b8dc2cc77224c65dc45
SHA512

575a9f43c92766a19d634a3f7a8ee5e2469b87697c3e5b94766c0c873c6b2666357b254522c33d4ee2e61e7f74381d18c192a4734809ff7b87d047c1146f16f3
SSDEEP

98304:Dd1m7PJGpbe9ouaJKkZVxtyNCnp3bGx9:DmkeOucVxxns

Score

10^/10

unicornstealer spyware stealer

Malware Config

Signatures

UnicornStealer
UnicornStealer is a modular infostealer written in C++.
stealer unicornstealer

Unicorn Stealer payload 18 IoCs

stealer

resource	yara_rule
behavioral1/memory/2796-28-0x0000000004E10000-0x0000000004F60000-memory.dmp	unicorn
behavioral1/memory/2204-30-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-31-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-40-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-42-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-43-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-47-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-49-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-48-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-52-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-46-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-57-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-64-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-69-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-70-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-76-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-77-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2204-78-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	rundll32.exe
2796	svchost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe
2204	dllhost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2796	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	rundll32.exe
2204	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2856 wrote to memory of 2676	2856	rundll32.exe	28
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2676 wrote to memory of 2796	2676	rundll32.exe	29
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34
PID 2796 wrote to memory of 2204	2796	svchost.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00bbfc3ef12abbded0f521cb79cd183d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00bbfc3ef12abbded0f521cb79cd183d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-52-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-76-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-78-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-77-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-42-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-70-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-69-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-30-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-31-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-32-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2204-33-0x0000000077110000-0x00000000772B9000-memory.dmp

Filesize
1.7MB

Download
memory/2204-43-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-64-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-40-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-57-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-47-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-49-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-48-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2204-46-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2676-0-0x0000000001FA0000-0x00000000026E8000-memory.dmp

Filesize
7.3MB

Download
memory/2676-1-0x0000000001FA0000-0x00000000026E8000-memory.dmp

Filesize
7.3MB

Download
memory/2676-3-0x0000000001FA0000-0x00000000026E8000-memory.dmp

Filesize
7.3MB

Download
memory/2796-38-0x0000000004E10000-0x0000000004F60000-memory.dmp

Filesize
1.3MB

Download
memory/2796-29-0x0000000077110000-0x00000000772B9000-memory.dmp

Filesize
1.7MB

Download
memory/2796-28-0x0000000004E10000-0x0000000004F60000-memory.dmp

Filesize
1.3MB

Download
memory/2796-27-0x0000000000910000-0x0000000000918000-memory.dmp

Filesize
32KB

Download
memory/2796-2-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download