Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad19f86e0e75004e66e34eba3e962dfc.dll
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad19f86e0e75004e66e34eba3e962dfc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ad19f86e0e75004e66e34eba3e962dfc.dll
-
Size
1.7MB
-
MD5
ad19f86e0e75004e66e34eba3e962dfc
-
SHA1
c4a15051db58dd05030f395e3628f3eb23522b79
-
SHA256
42a01e08a5f90d82163a81412a7aaf55a89db62f9f6c5933c7e1c9ee520df03b
-
SHA512
da0ed82ce65563fd2614a1fa5eed3afcce7ebddd495eb85cde822e2eeebd5b40b222349a17afa846579d5a14d7f6f142ab1edbbc7cf581d283ea87745404d350
-
SSDEEP
24576:S4pLEZif00JxEAXqCvRAQKNDmWEAeApxOGl+Z4h0pZB5v31rIyOlIM+SSZPU:SGYZifFEAXr6fyaYp3Oy3Sc8
Score
10/10
Malware Config
Signatures
-
UnicornStealer
UnicornStealer is a modular infostealer written in C++.
-
Unicorn Stealer payload 17 IoCs
resource yara_rule behavioral2/memory/1640-10-0x0000000005530000-0x0000000005680000-memory.dmp unicorn behavioral2/memory/1932-12-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-13-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-17-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-19-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-20-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-22-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-24-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-25-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-26-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-27-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-28-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-29-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-37-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-42-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-45-0x0000000000400000-0x000000000053C000-memory.dmp unicorn behavioral2/memory/1932-52-0x0000000000400000-0x000000000053C000-memory.dmp unicorn -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3476 rundll32.exe 1640 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1640 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1932 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3476 4852 rundll32.exe 88 PID 4852 wrote to memory of 3476 4852 rundll32.exe 88 PID 4852 wrote to memory of 3476 4852 rundll32.exe 88 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97 PID 3476 wrote to memory of 1640 3476 rundll32.exe 97
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad19f86e0e75004e66e34eba3e962dfc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad19f86e0e75004e66e34eba3e962dfc.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1640 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
-