9d67ce79c7857cd13935d6ae14d57d4c78ffa77e997a5271bfa6bbee6925de1d

Analysis

max time kernel
12s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d87c25ef16d7981b0f2caef1cbdf005.exe
Size

184KB
MD5

3d87c25ef16d7981b0f2caef1cbdf005
SHA1

c86d4672588e4a6d7a856d88e673ab045c1d5505
SHA256

9d67ce79c7857cd13935d6ae14d57d4c78ffa77e997a5271bfa6bbee6925de1d
SHA512

c7911dca54f0c7611aa69ada6645c2fe32c05a0af10ce70ea7229131bdbed9a44e29f7647c0bb359abb1cbeff885739c23f93958ab6736603a4c096a7211cbe0
SSDEEP

3072:FGH8omLYPOf0nOjbMQ/YvJ01gQ0M9aheJSxKrafuNlPvpFC:FGcoHs0n0M6YvJ8K0LNlPvpF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2164	Unicorn-32795.exe
2652	Unicorn-8337.exe
2664	Unicorn-23282.exe
2376	Unicorn-4336.exe
2396	Unicorn-54092.exe
2692	Unicorn-8420.exe
2624	Unicorn-13656.exe
2156	Unicorn-5720.exe

Loads dropped DLL 16 IoCs

pid	Process
2288	3d87c25ef16d7981b0f2caef1cbdf005.exe
2288	3d87c25ef16d7981b0f2caef1cbdf005.exe
2164	Unicorn-32795.exe
2164	Unicorn-32795.exe
2288	3d87c25ef16d7981b0f2caef1cbdf005.exe
2288	3d87c25ef16d7981b0f2caef1cbdf005.exe
2652	Unicorn-8337.exe
2652	Unicorn-8337.exe
2164	Unicorn-32795.exe
2664	Unicorn-23282.exe
2164	Unicorn-32795.exe
2664	Unicorn-23282.exe
2376	Unicorn-4336.exe
2376	Unicorn-4336.exe
2652	Unicorn-8337.exe
2652	Unicorn-8337.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2288	3d87c25ef16d7981b0f2caef1cbdf005.exe
2164	Unicorn-32795.exe
2652	Unicorn-8337.exe
2664	Unicorn-23282.exe
2376	Unicorn-4336.exe
2396	Unicorn-54092.exe
2692	Unicorn-8420.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2164	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	28
PID 2288 wrote to memory of 2164	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	28
PID 2288 wrote to memory of 2164	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	28
PID 2288 wrote to memory of 2164	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	28
PID 2164 wrote to memory of 2652	2164	Unicorn-32795.exe	30
PID 2164 wrote to memory of 2652	2164	Unicorn-32795.exe	30
PID 2164 wrote to memory of 2652	2164	Unicorn-32795.exe	30
PID 2164 wrote to memory of 2652	2164	Unicorn-32795.exe	30
PID 2288 wrote to memory of 2664	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	29
PID 2288 wrote to memory of 2664	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	29
PID 2288 wrote to memory of 2664	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	29
PID 2288 wrote to memory of 2664	2288	3d87c25ef16d7981b0f2caef1cbdf005.exe	29
PID 2652 wrote to memory of 2376	2652	Unicorn-8337.exe	33
PID 2652 wrote to memory of 2376	2652	Unicorn-8337.exe	33
PID 2652 wrote to memory of 2376	2652	Unicorn-8337.exe	33
PID 2652 wrote to memory of 2376	2652	Unicorn-8337.exe	33
PID 2164 wrote to memory of 2396	2164	Unicorn-32795.exe	32
PID 2164 wrote to memory of 2396	2164	Unicorn-32795.exe	32
PID 2164 wrote to memory of 2396	2164	Unicorn-32795.exe	32
PID 2164 wrote to memory of 2396	2164	Unicorn-32795.exe	32
PID 2664 wrote to memory of 2692	2664	Unicorn-23282.exe	31
PID 2664 wrote to memory of 2692	2664	Unicorn-23282.exe	31
PID 2664 wrote to memory of 2692	2664	Unicorn-23282.exe	31
PID 2664 wrote to memory of 2692	2664	Unicorn-23282.exe	31
PID 2376 wrote to memory of 2624	2376	Unicorn-4336.exe	38
PID 2376 wrote to memory of 2624	2376	Unicorn-4336.exe	38
PID 2376 wrote to memory of 2624	2376	Unicorn-4336.exe	38
PID 2376 wrote to memory of 2624	2376	Unicorn-4336.exe	38
PID 2652 wrote to memory of 2156	2652	Unicorn-8337.exe	82
PID 2652 wrote to memory of 2156	2652	Unicorn-8337.exe	82
PID 2652 wrote to memory of 2156	2652	Unicorn-8337.exe	82
PID 2652 wrote to memory of 2156	2652	Unicorn-8337.exe	82

C:\Users\Admin\AppData\Local\Temp\3d87c25ef16d7981b0f2caef1cbdf005.exe
"C:\Users\Admin\AppData\Local\Temp\3d87c25ef16d7981b0f2caef1cbdf005.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        5⤵
        Executes dropped EXE
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        6⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        7⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        9⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29411.exe
        10⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
        11⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        12⤵
        Executes dropped EXE
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        8⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        9⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
        6⤵
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        9⤵
        
        PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        6⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13127.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        8⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        6⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        7⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        8⤵
        
        PID:964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
        7⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        6⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        8⤵
        
        PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        5⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        8⤵
        
        PID:1532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        5⤵
        
        PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
      4⤵
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        6⤵
        
        PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
    3⤵
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
      4⤵
      PID:480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        6⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        7⤵
        
        PID:576

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads