Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 17:20
General
- Target 2026-07-05_05b244a2d052f5fe262df0d80ade3f9b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 17.7MB
- Sample260705-vwlwesev2x
- SHA256 dfcb8744351f10d0c4247449c01b008d2cf661df1379f23ceb74058566daa94b
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 56 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 34 IoCs
- UPX dump on OEP (original entry point) 34 IoCs
- Executes dropped EXE 12 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_05b244a2d052f5fe262df0d80ade3f9b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_05b244a2d052f5fe262df0d80ade3f9b_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46881.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4870.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55472.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39068.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5670.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24594.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39140.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10802.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26894.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38788.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63921.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23953.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28774.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13153.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55886.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21815.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18917.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35587.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56282.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30999.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10636.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1062.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60420.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-1886.exe
Unicorn-19697.exe
Unicorn-2021.exe
Unicorn-21202.exe
Unicorn-22831.exe
Unicorn-23096.exe
Unicorn-28441.exe
Unicorn-30444.exe
Unicorn-31434.exe
Unicorn-3253.exe
Unicorn-3277.exe
Unicorn-34964.exe
Unicorn-3645.exe
Unicorn-37103.exe
Unicorn-38975.exe
Unicorn-39140.exe
Unicorn-40527.exe
Unicorn-41985.exe
Unicorn-46881.exe
Unicorn-4870.exe
Unicorn-55040.exe
Unicorn-55472.exe
Unicorn-55886.exe
Unicorn-59119.exe
Unicorn-61290.exe
Unicorn-62016.exe
Unicorn-62359.exe
Unicorn-6245.exe
Unicorn-62807.exe
Unicorn-63640.exe
Unicorn-63767.exe
Unicorn-6494.exe
Unicorn-9074.exe
Unicorn-9800.exe
memory/844-462-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1180-1150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1220-278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1412-803-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1428-558-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1512-277-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1604-128-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1624-450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1792-65-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1852-799-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1872-941-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1904-447-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-110-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2136-637-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2344-758-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2516-377-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2556-478-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2672-756-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2784-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2872-448-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2960-325-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3064-93-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3068-1187-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3120-92-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-757-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-449-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3480-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3528-461-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3708-805-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3924-801-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3936-573-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4520-274-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4984-802-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5056-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5152-459-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5240-797-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5372-348-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5456-463-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5504-557-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5532-460-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5816-466-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5868-275-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6012-458-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6028-880-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6336-1190-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6352-942-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6364-961-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6384-962-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6524-1191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6816-1192-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6856-1193-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6916-1194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6924-1195-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6944-1196-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6952-1329-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6992-1248-0x0000000000400000-0x0000000000475000-memory.dmp