unix_stealer | 58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02

General

Target
_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
Size 2.5MB
Sample260503-yncjkabx5q
SHA256 58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02
MD5 3b7a70bc5a21912298ff0faf2b2be20d
SHA1 c572265ac048c7b540a05eb07158818d5a2e90ec
SHA512 4b64ae596ce61533ddcd1a8e404a0bd4ba3c8d0740485edfb9bd686f08a6e592d3dbfbf2db77bccf340408ac051fa562ab0b509e0a10930fa1be60a373260a8a
SSDEEP 24576:gS0RZih0oUQyc4dDTfHvJZ+IOfO49ssbhFwLZ8reboA/N2t675hbQ3+XuCML83iT:CJuQfK9XZk/k1t5
TLSH
T150C50102451C90D7E9AB37345059A9779370ED35B998CECEFAE980BF276BC421E38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery unix_stealer spyware stealer

Malware Config

Signatures

Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
stealer unix_stealer

Detects UnixStealer payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002433d-2.dat	family_unixstealer
behavioral1/memory/4496-4-0x000001D853D70000-0x000001D853DC0000-memory.dmp	family_unixstealer

Executes dropped EXE 1 IoCs

pid	Process
4496	tmp40DC.tmp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	discord.com
15	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	tmp40DC.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	tmp40DC.tmp.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
4496	tmp40DC.tmp.exe
4496	tmp40DC.tmp.exe
4496	tmp40DC.tmp.exe
4496	tmp40DC.tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	tmp40DC.tmp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4372	4664	_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe	85
PID 4372 wrote to memory of 4496	4372	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe
"C:\Users\Admin\AppData\Local\Temp\_58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\tmp40DC.tmp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\tmp40DC.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp40DC.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp40DC.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp40DC.tmp.exe
Size 296KB
SHA256 3a07c8cd504c54253b3a1f6cc92ada0c23ef3457e19b98592934f5d03a103a76
MD5 ea6fcb2a47012936517dbaff3883a728
SHA1 2490a6c7905cd3a7aaddb5ca4c816f9eafad02c5
SHA512 7e1681be2dd738caf7ee5ecbfc81ad6e4881bb930a81f6cac035d68f8355cd521198a50f3c62722c557d83f5a54109aecd76e60e094791fe345a032f0de17024
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pU4:Hh6OTyejyThvFhIpQrAHYR/H7U4
TLSH
T177545C0127ED465AF2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4183.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp4183.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4196.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp4196.tmp.dat
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4496-4-0x000001D853D70000-0x000001D853DC0000-memory.dmp

Download

memory/4496-22-0x000001D8541A0000-0x000001D8541B0000-memory.dmp

Download

memory/4496-140-0x000001D8541D0000-0x000001D8541DC000-memory.dmp

Download

memory/4496-141-0x000001D86E640000-0x000001D86E6E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads