Analysis
- max time kernel
35s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 19:26
General
- Target 2026-07-09_57df564dc778e32ff25c26ef8be7c399_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe
- Size 21.6MB
- Sample260709-x5lm5ahw21
- SHA256 2a943d903f4b32eb9c8a4fdd8a135cf0528fc62f0192b2962aace9a41a2cafe1
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 56 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 18 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 31 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_57df564dc778e32ff25c26ef8be7c399_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_57df564dc778e32ff25c26ef8be7c399_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50861.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49299.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53222.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40891.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42885.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11825.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39237.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18625.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55552.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3236.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38033.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2324.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55936.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17359.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26684.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16435.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7752.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59444.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12573.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50991.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18926.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23233.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18968.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3881.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57280.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5411.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39189.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50591.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63870.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41759.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50591.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9495.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11825.exe
Unicorn-15739.exe
Unicorn-17336.exe
Unicorn-17957.exe
Unicorn-19801.exe
Unicorn-25147.exe
Unicorn-27991.exe
Unicorn-29361.exe
Unicorn-32467.exe
Unicorn-33144.exe
Unicorn-33150.exe
Unicorn-34187.exe
Unicorn-35810.exe
Unicorn-3787.exe
Unicorn-40221.exe
Unicorn-42989.exe
Unicorn-43979.exe
Unicorn-52611.exe
Unicorn-53273.exe
Unicorn-5411.exe
Unicorn-59238.exe
Unicorn-61384.exe
Unicorn-63870.exe
Unicorn-64251.exe
Unicorn-64913.exe
Unicorn-65110.exe
Unicorn-7570.exe
Unicorn-8348.exe
Unicorn-8940.exe
Unicorn-9495.exe
Unicorn-53827.exe
memory/204-455-0x0000000000400000-0x0000000000475000-memory.dmp
memory/624-831-0x0000000000400000-0x0000000000475000-memory.dmp
memory/700-462-0x0000000000400000-0x0000000000475000-memory.dmp
memory/756-450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1216-453-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1248-774-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1276-472-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1280-456-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1340-595-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1532-531-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1656-458-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1696-655-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2056-537-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2160-451-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2192-535-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2296-653-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2352-597-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2404-461-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2536-541-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2620-749-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-829-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2868-783-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3408-746-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3644-534-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3664-536-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3668-773-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3684-649-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3744-604-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3896-216-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4084-121-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4164-558-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4328-849-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4336-532-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4356-459-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4392-552-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4428-650-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4456-454-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4488-651-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4596-463-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4608-869-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4612-574-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4712-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-828-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-784-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4996-457-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5004-785-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5144-591-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5248-538-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5452-449-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5660-227-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5664-583-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5700-452-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5828-540-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5840-592-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5856-539-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6024-654-0x0000000000400000-0x0000000000475000-memory.dmp