511bff9b75f5e3b27da036dc1ee554915f508cbe1441dd43c77746145b2bb8cd

Analysis

max time kernel
12s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

458e9024252516e6db4764f748f531c7.exe
Size

184KB
MD5

458e9024252516e6db4764f748f531c7
SHA1

c6fe2bb82a684185d745cb298d48ca07eea10b1d
SHA256

511bff9b75f5e3b27da036dc1ee554915f508cbe1441dd43c77746145b2bb8cd
SHA512

a60c7158c17a897dbe9a7610e6cf8daef423fd452febc05b12f5c7e12e87c67357adbf589d99eba29936b8432ffb714a795536431aaf9ad10ecaf746206be00f
SSDEEP

3072:y8kjomNLPUT0nOjLM3b3CJ01kb0MLflF8SxKK01MNlPvxFo:y8IoSm0nYML3CJLNWONlPvxF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1968	Unicorn-11627.exe
1748	Unicorn-8752.exe
2708	Unicorn-46256.exe
2604	Unicorn-11378.exe
2876	Unicorn-48882.exe
2644	Unicorn-60579.exe
1620	Unicorn-683.exe
3064	Unicorn-38186.exe

Loads dropped DLL 16 IoCs

pid	Process
1224	458e9024252516e6db4764f748f531c7.exe
1224	458e9024252516e6db4764f748f531c7.exe
1968	Unicorn-11627.exe
1968	Unicorn-11627.exe
1224	458e9024252516e6db4764f748f531c7.exe
1224	458e9024252516e6db4764f748f531c7.exe
1748	Unicorn-8752.exe
1748	Unicorn-8752.exe
1968	Unicorn-11627.exe
1968	Unicorn-11627.exe
2708	Unicorn-46256.exe
2708	Unicorn-46256.exe
2604	Unicorn-11378.exe
2604	Unicorn-11378.exe
1748	Unicorn-8752.exe
1748	Unicorn-8752.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1764	1680	WerFault.exe	36
2836	2612	WerFault.exe	64

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1224	458e9024252516e6db4764f748f531c7.exe
1968	Unicorn-11627.exe
1748	Unicorn-8752.exe
2708	Unicorn-46256.exe
2604	Unicorn-11378.exe
2876	Unicorn-48882.exe
2644	Unicorn-60579.exe
1620	Unicorn-683.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1968	1224	458e9024252516e6db4764f748f531c7.exe	28
PID 1224 wrote to memory of 1968	1224	458e9024252516e6db4764f748f531c7.exe	28
PID 1224 wrote to memory of 1968	1224	458e9024252516e6db4764f748f531c7.exe	28
PID 1224 wrote to memory of 1968	1224	458e9024252516e6db4764f748f531c7.exe	28
PID 1968 wrote to memory of 1748	1968	Unicorn-11627.exe	30
PID 1968 wrote to memory of 1748	1968	Unicorn-11627.exe	30
PID 1968 wrote to memory of 1748	1968	Unicorn-11627.exe	30
PID 1968 wrote to memory of 1748	1968	Unicorn-11627.exe	30
PID 1224 wrote to memory of 2708	1224	458e9024252516e6db4764f748f531c7.exe	29
PID 1224 wrote to memory of 2708	1224	458e9024252516e6db4764f748f531c7.exe	29
PID 1224 wrote to memory of 2708	1224	458e9024252516e6db4764f748f531c7.exe	29
PID 1224 wrote to memory of 2708	1224	458e9024252516e6db4764f748f531c7.exe	29
PID 1748 wrote to memory of 2604	1748	Unicorn-8752.exe	33
PID 1748 wrote to memory of 2604	1748	Unicorn-8752.exe	33
PID 1748 wrote to memory of 2604	1748	Unicorn-8752.exe	33
PID 1748 wrote to memory of 2604	1748	Unicorn-8752.exe	33
PID 1968 wrote to memory of 2876	1968	Unicorn-11627.exe	32
PID 1968 wrote to memory of 2876	1968	Unicorn-11627.exe	32
PID 1968 wrote to memory of 2876	1968	Unicorn-11627.exe	32
PID 1968 wrote to memory of 2876	1968	Unicorn-11627.exe	32
PID 2708 wrote to memory of 2644	2708	Unicorn-46256.exe	31
PID 2708 wrote to memory of 2644	2708	Unicorn-46256.exe	31
PID 2708 wrote to memory of 2644	2708	Unicorn-46256.exe	31
PID 2708 wrote to memory of 2644	2708	Unicorn-46256.exe	31
PID 2604 wrote to memory of 1620	2604	Unicorn-11378.exe	38
PID 2604 wrote to memory of 1620	2604	Unicorn-11378.exe	38
PID 2604 wrote to memory of 1620	2604	Unicorn-11378.exe	38
PID 2604 wrote to memory of 1620	2604	Unicorn-11378.exe	38
PID 1748 wrote to memory of 3064	1748	Unicorn-8752.exe	37
PID 1748 wrote to memory of 3064	1748	Unicorn-8752.exe	37
PID 1748 wrote to memory of 3064	1748	Unicorn-8752.exe	37
PID 1748 wrote to memory of 3064	1748	Unicorn-8752.exe	37

C:\Users\Admin\AppData\Local\Temp\458e9024252516e6db4764f748f531c7.exe
"C:\Users\Admin\AppData\Local\Temp\458e9024252516e6db4764f748f531c7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        7⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe
        8⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe
        9⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        10⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        8⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        9⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43198.exe
        8⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18201.exe
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        7⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65027.exe
        8⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23324.exe
        5⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        6⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        8⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        7⤵
        
        PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
      4⤵
      Executes dropped EXE
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43198.exe
        8⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
        7⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        7⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64980.exe
        6⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 200
        7⤵
        Program crash
        
        PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57092.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40284.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        8⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        6⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe
        8⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        5⤵
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        6⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40977.exe
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52234.exe
        9⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        6⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        7⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        8⤵
        
        PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
        6⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29162.exe
        5⤵
        
        PID:3068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 240
        5⤵
        Program crash
        
        PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
      4⤵
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        5⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        6⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3389.exe
        6⤵
        
        PID:1940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20506.exe
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        6⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe
        5⤵
        
        PID:300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        6⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        7⤵
        
        PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
      4⤵
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        
        PID:2124

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads