Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 06:22
General
- Target 2026-07-09_c3abef095a6c61fd013e3a9559fbc987_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 17.7MB
- Sample260709-g4vxeaet8s
- SHA256 a20ae2ce175e40d9e4b7681f1834544ce94cc744585329ac5855e46c7f54568e
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 18 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_c3abef095a6c61fd013e3a9559fbc987_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_c3abef095a6c61fd013e3a9559fbc987_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23894.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50251.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37846.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65125.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36354.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10106.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60224.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64729.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26484.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3505.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23516.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29078.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11383.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-375.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20511.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41996.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15621.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46640.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64496.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55639.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25416.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24191.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28055.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17941.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57257.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29537.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18224.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61985.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60224.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51782.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42659.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35032.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32201.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14175.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11330.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10384.exe
Unicorn-11204.exe
Unicorn-13399.exe
Unicorn-1412.exe
Unicorn-21055.exe
Unicorn-21153.exe
Unicorn-22088.exe
Unicorn-23516.exe
Unicorn-23678.exe
Unicorn-23894.exe
Unicorn-2481.exe
Unicorn-28055.exe
Unicorn-31070.exe
Unicorn-32851.exe
Unicorn-34790.exe
Unicorn-37846.exe
Unicorn-39622.exe
Unicorn-45695.exe
Unicorn-46664.exe
Unicorn-47084.exe
Unicorn-48153.exe
Unicorn-49636.exe
Unicorn-50251.exe
Unicorn-51299.exe
Unicorn-51782.exe
Unicorn-53171.exe
Unicorn-53628.exe
Unicorn-55766.exe
Unicorn-57257.exe
Unicorn-6110.exe
Unicorn-9580.exe
memory/252-354-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1528-208-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2024-644-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2240-278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2544-732-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3120-645-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3576-444-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3712-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3720-445-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3776-744-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3972-508-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4232-364-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4740-591-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4748-643-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4872-471-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5696-592-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5868-556-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6136-622-0x0000000000400000-0x0000000000475000-memory.dmp