Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
44dccd1d8b57ee3b5a8c7833f3cb9d72.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
44dccd1d8b57ee3b5a8c7833f3cb9d72.dll
Resource
win10v2004-20231222-en
General
-
Target
44dccd1d8b57ee3b5a8c7833f3cb9d72.dll
-
Size
3.6MB
-
MD5
44dccd1d8b57ee3b5a8c7833f3cb9d72
-
SHA1
faec40b6e2f6b452c273b9ff2cb8101e8c554d5e
-
SHA256
06c438f25d9fd9ced6066c62b1e9b6097401304289d3130e6a3af34e417eab49
-
SHA512
b14a8131b47054132f511723d6ffaa5ca7bae9ddf907a0dd624ff3bb116737105806f6819a99433fcb0fbfeee223360e13d05496546e2a0eb947b6aedd8e293b
-
SSDEEP
49152:3tiEM3qSat9+rZufjlxnyqxSgF8CP4rhDTF+2huh:3tT4ZurlL8CP4rh1+gu
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 15 IoCs
resource yara_rule behavioral1/memory/1532-31-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-32-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-36-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-39-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-42-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-47-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-51-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-55-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-59-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-48-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-46-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-41-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-38-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-37-0x0000000000400000-0x0000000000532000-memory.dmp unicorn behavioral1/memory/1532-76-0x0000000000400000-0x0000000000532000-memory.dmp unicorn -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3048 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1052 wrote to memory of 3048 1052 rundll32.exe 16 PID 1052 wrote to memory of 3048 1052 rundll32.exe 16 PID 1052 wrote to memory of 3048 1052 rundll32.exe 16 PID 1052 wrote to memory of 3048 1052 rundll32.exe 16 PID 1052 wrote to memory of 3048 1052 rundll32.exe 16 PID 1052 wrote to memory of 3048 1052 rundll32.exe 16 PID 1052 wrote to memory of 3048 1052 rundll32.exe 16
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44dccd1d8b57ee3b5a8c7833f3cb9d72.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44dccd1d8b57ee3b5a8c7833f3cb9d72.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3048 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵PID:2500
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵PID:1532
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311KB
MD5d45bce70d3c639d8bb205b9947229ac6
SHA12114d59254fa7cf9790e2386919847a3da9b52b6
SHA256f7ef84635a5cd75e54c371f509a8737800f25b1b8c9357c2454df4046ff6b65b
SHA51260925a1261fa9c504f4d3c49db217b8a6621d29fc996ca088df3078a327168214a9d3dcdf222e21a5901d78b68fb5c5a25d88f8e05a5b6db01b0f697c3c983f5