Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 21:35
General
- Target 2026-07-02_07e796f62df8df1d5312920b27040ee0_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe
- Size 34.1MB
- Sample260702-1fe1tsft31
- SHA256 b053d61c2995c7f6d743079d8d886eeb227009bfbe77001dcf6e742e4a335980
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 20 IoCs
- Detects executables Discord URL observed in first stage droppers 38 IoCs
- Detects executables containing possible sandbox analysis VM usernames 24 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 24 IoCs
- UPX dump on OEP (original entry point) 39 IoCs
- Executes dropped EXE 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 38 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_07e796f62df8df1d5312920b27040ee0_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_07e796f62df8df1d5312920b27040ee0_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38120.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11890.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10511.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25456.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24409.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14595.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25456.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41238.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39702.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1667.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10511.exe
Unicorn-11670.exe
Unicorn-14595.exe
Unicorn-15560.exe
Unicorn-19092.exe
Unicorn-20715.exe
Unicorn-24865.exe
Unicorn-25456.exe
Unicorn-25456.exe
Unicorn-30996.exe
Unicorn-31977.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35426.exe
Unicorn-35620.exe
Unicorn-35983.exe
Unicorn-36232.exe
Unicorn-37684.exe
Unicorn-38120.exe
Unicorn-38777.exe
Unicorn-39702.exe
Unicorn-39702.exe
Unicorn-41238.exe
Unicorn-42759.exe
Unicorn-43276.exe
Unicorn-43276.exe
Unicorn-49406.exe
Unicorn-56132.exe
Unicorn-57550.exe
Unicorn-58328.exe
Unicorn-62262.exe
Unicorn-6427.exe
Unicorn-6427.exe
Unicorn-8465.exe
memory/752-221-0x0000000000400000-0x0000000000475000-memory.dmp
memory/928-302-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1224-413-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1248-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1392-415-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1560-398-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1768-412-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1812-479-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2108-299-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3636-305-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3736-28-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3756-219-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4280-396-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4616-220-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4724-400-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4868-222-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5080-416-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5376-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5792-491-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5852-414-0x0000000000400000-0x0000000000475000-memory.dmp