Overview

overview

10

Static

static

10

2026-07-01...bo.exe

windows10-2004-x64

10

2026-07-01...bo.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    51s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 09:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_735d9dbb1c4e0950c501d39eeb78c57e_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
  • Size 36.1MB
  • Sample260701-ld6nfaav9l
  • SHA256 109f2bba8da5729fe869fe41092ea57b43e47ec23d233a4e3aa533326934ba16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverykawaiiunicorninstallertrojan

Malware Config

Signatures

  • Family: KawaiiUnicorn

    KawaiiUnicorn is a trojan written in Visual Basic.

    trojankawaiiunicorn
  • Detects KawaiiUnicorn 4 IoCs
  • Detects executables Discord URL observed in first stage droppers 30 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 30 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 30 IoCs
  • UPX dump on OEP (original entry point) 30 IoCs
  • Executes dropped EXE 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 30 IoCs

    Inno Setup installer

    installer
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_735d9dbb1c4e0950c501d39eeb78c57e_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_735d9dbb1c4e0950c501d39eeb78c57e_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5424
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:268
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1956
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5212
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
              6⤵
                PID:3808
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
              5⤵
                PID:4848
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
              4⤵
                PID:1320
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
                  5⤵
                    PID:1768
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
                  4⤵
                    PID:4312
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5468
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2804
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
                      5⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:920
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
                        6⤵
                          PID:3620
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
                        5⤵
                          PID:2472
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:5792
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
                          5⤵
                            PID:4276
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
                          4⤵
                            PID:4952
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2552
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:2720
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
                              5⤵
                                PID:5816
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
                              4⤵
                                PID:5644
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
                              3⤵
                                PID:2652
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
                                  4⤵
                                    PID:4480
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
                                  3⤵
                                    PID:4100
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:252
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3336
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4732
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-20231.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-20231.exe
                                        5⤵
                                          PID:5868
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
                                        4⤵
                                          PID:4524
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3980
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
                                          4⤵
                                            PID:1408
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
                                          3⤵
                                            PID:2500
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
                                          2⤵
                                            PID:3296
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
                                              3⤵
                                                PID:5360
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
                                              2⤵
                                                PID:3856

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  Unicorn-1051.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
                                                  • Size 36.1MB
                                                  • SHA256 1cd8695f6e0aa8e154e24c359e93241b4a79539f0c647b6fc9bd6cf2f9158f32
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-12127.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
                                                  • Size 36.1MB
                                                  • SHA256 2dce0fb675c4c9387be1cf523641fa3a941ef67139187ce3ae332d963a4f9a7e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-13303.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
                                                  • Size 36.1MB
                                                  • SHA256 a7c9b9db06815c83935262b2d4f165854ffa4d4097dc390833a99b14635227ba
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-1465.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
                                                  • Size 36.1MB
                                                  • SHA256 a5b3cf87c214bb1525532b348615d9f8922337cc13623361d4ece59c3247b1d8
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-15946.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
                                                  • Size 36.1MB
                                                  • SHA256 5e75a9b8fa19201e3be730213e0b0ca33040cb2979bdeefb5a6d61662834ba6a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-1872.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
                                                  • Size 36.1MB
                                                  • SHA256 bde9aa1113580eb05185d8b311c8639b0dc3ebdd1a308f639585d01e0228c265
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-18971.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
                                                  • Size 36.1MB
                                                  • SHA256 d0b45a9b6f760da8efb6a81b4ed44353b7bb17fa95fec2a0ce7847622e3e4d87
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-19973.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
                                                  • Size 36.1MB
                                                  • SHA256 52b5de7a22991ecdcb06479e40727c8cc4cb05a5141896a374803af0a2fe6e50
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-2163.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
                                                  • Size 36.1MB
                                                  • SHA256 ce1e2d0f239ee8e287de6f7f4e015fd22137a89886c19b07dcbd332b8e15fa0b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-23330.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
                                                  • Size 36.1MB
                                                  • SHA256 94b8c821ef2a5fa889bf3bbb75d131d0b631ae1f9f457b574cc36bf24d0194c8
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-23937.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
                                                  • Size 36.1MB
                                                  • SHA256 bf84b81b6a4006f0d995aacd7d2f204248ccc85e10a462305d2a488c3374ff79
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-24232.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
                                                  • Size 36.1MB
                                                  • SHA256 d0bdcde9171a9fc7ab2b7c8d312a6e3a7fae6acceea74e8b0a70aed5637270f1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-25001.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
                                                  • Size 36.1MB
                                                  • SHA256 340ed4ab7085ceaef6458f65c701da5d12d9fcd7ec89c6e9f5c3e71eac3329f1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-26253.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
                                                  • Size 36.1MB
                                                  • SHA256 6a6c2ee026e90091de46ef902d9893dafa12dbe46ede0ccc2f8f3218cac2622d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-30363.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
                                                  • Size 36.1MB
                                                  • SHA256 cd191e298f379e4c28b2a0c45252ef6b982d30dad25d05468e67af3c1c26258e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-32428.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
                                                  • Size 36.1MB
                                                  • SHA256 19c25e194359f2b0071a983787139ac1fbfcfdb6b91692cf0f9b9cb32e2e290b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-33169.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
                                                  • Size 36.1MB
                                                  • SHA256 a00e324747c3c28bd29d824f1657543102b7370c08d8be6722c29f1fad57436f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-42854.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
                                                  • Size 36.1MB
                                                  • SHA256 96371a130edb956b30a9a8f549312e006658accf752f8dab9e4ce388c1218d16
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-43684.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
                                                  • Size 36.1MB
                                                  • SHA256 4143969475a8bd0ceb8172b7c5dceaf6aa5206b72eff2e699f4cba0d036fe9e7
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-43923.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
                                                  • Size 36.1MB
                                                  • SHA256 edfb52c74e5e61c82293c070ae7d48971c688455e0ffbe0f6060b77d572f5ffc
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-44444.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
                                                  • Size 36.1MB
                                                  • SHA256 063b2d38ca80024bab7888d340704fed4cb49a357ea992d3f61bc8e7bb9c93c0
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-46490.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
                                                  • Size 36.1MB
                                                  • SHA256 4683e1720c2adaf934e79ced57386794987df8eb05981cb4293ec5aad2cd29ef
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-46938.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
                                                  • Size 36.1MB
                                                  • SHA256 4546f3018c7bc74e49ca9e0fd115644fc3a0444eaff8153b70408f858a43c461
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-50574.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
                                                  • Size 36.1MB
                                                  • SHA256 d5f870a444618dbf9837efbf315351ffeb50888783529c6f16655f439036c829
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-53232.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
                                                  • Size 36.1MB
                                                  • SHA256 b61e80a757fc28a70044f0df43836e8359a4a891dfc5df4be010f49f0c7984de
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-5549.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
                                                  • Size 36.1MB
                                                  • SHA256 f9daaf593f617eebf3a361ac1dcecc42b2a923e7107d1535d7bb83482fc9bd68
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-57799.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
                                                  • Size 36.1MB
                                                  • SHA256 7e35a471bde6f0f6d85a6d9f49c954631c9082a155836b8d18ab385679b61366
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-59049.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
                                                  • Size 36.1MB
                                                  • SHA256 f5ee19157e9e67c4afc7fcbbfe4653471bfdec0b286e60786d0076b1dd24fb2b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-61883.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
                                                  • Size 36.1MB
                                                  • SHA256 5ec06160725b335235bf384e97a73cd7cae62a13de6e1856bc1159db2ec653f2
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Unicorn-6204.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
                                                  • Size 36.1MB
                                                  • SHA256 f0184a033f4198c1e7d4a2f224d6323d51504b959953cbaf8d9c1d34d2d58597
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  memory/2012-0-0x0000000000400000-0x0000000000475000-memory.dmp
                                                  Download

                                                  memory/3296-114-0x0000000000400000-0x0000000000475000-memory.dmp
                                                  Download

                                                  memory/3808-192-0x0000000000400000-0x0000000000475000-memory.dmp
                                                  Download

                                                  memory/4732-102-0x0000000000400000-0x0000000000475000-memory.dmp
                                                  Download