unicornstealer | 42a01e08a5f90d82163a81412a7aaf55a89db62f9f6c5933c7e1c9ee520df03b

Analysis

max time kernel
151s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad19f86e0e75004e66e34eba3e962dfc.dll
Size

1.7MB
MD5

ad19f86e0e75004e66e34eba3e962dfc
SHA1

c4a15051db58dd05030f395e3628f3eb23522b79
SHA256

42a01e08a5f90d82163a81412a7aaf55a89db62f9f6c5933c7e1c9ee520df03b
SHA512

da0ed82ce65563fd2614a1fa5eed3afcce7ebddd495eb85cde822e2eeebd5b40b222349a17afa846579d5a14d7f6f142ab1edbbc7cf581d283ea87745404d350
SSDEEP

24576:S4pLEZif00JxEAXqCvRAQKNDmWEAeApxOGl+Z4h0pZB5v31rIyOlIM+SSZPU:SGYZifFEAXr6fyaYp3Oy3Sc8

Score

10^/10

unicornstealer spyware stealer

Malware Config

Signatures

UnicornStealer
UnicornStealer is a modular infostealer written in C++.
stealer unicornstealer

Unicorn Stealer payload 16 IoCs

stealer

resource	yara_rule
behavioral1/memory/2360-11-0x0000000004510000-0x0000000004660000-memory.dmp	unicorn
behavioral1/memory/2744-13-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-14-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-24-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-26-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-27-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-30-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-35-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-37-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-36-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-39-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-49-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-55-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-56-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-57-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn
behavioral1/memory/2744-58-0x0000000000400000-0x000000000053C000-memory.dmp	unicorn

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1392	rundll32.exe
2360	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe
2744	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2360	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 2308 wrote to memory of 1392	2308	rundll32.exe	28
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 1392 wrote to memory of 2360	1392	rundll32.exe	31
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32
PID 2360 wrote to memory of 2744	2360	svchost.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad19f86e0e75004e66e34eba3e962dfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad19f86e0e75004e66e34eba3e962dfc.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-8-0x00000000020E0000-0x0000000002295000-memory.dmp

Filesize
1.7MB

Download
memory/1392-1-0x00000000020E0000-0x0000000002295000-memory.dmp

Filesize
1.7MB

Download
memory/1392-6-0x00000000020E0000-0x0000000002295000-memory.dmp

Filesize
1.7MB

Download
memory/1392-0-0x00000000020E0000-0x0000000002295000-memory.dmp

Filesize
1.7MB

Download
memory/2360-22-0x0000000004510000-0x0000000004660000-memory.dmp

Filesize
1.3MB

Download
memory/2360-7-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download
memory/2360-11-0x0000000004510000-0x0000000004660000-memory.dmp

Filesize
1.3MB

Download
memory/2360-12-0x0000000076FB0000-0x0000000077159000-memory.dmp

Filesize
1.7MB

Download
memory/2360-10-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/2744-27-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-37-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-17-0x0000000076FB0000-0x0000000077159000-memory.dmp

Filesize
1.7MB

Download
memory/2744-14-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-24-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-26-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-13-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-30-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-35-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-16-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/2744-36-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-39-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-49-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-55-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-56-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-57-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2744-58-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download