Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 03:09
General
- Target 2026-08-01_6e864afcc3d429c0c7c4d6ab35093dfa_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
- Size 28.0MB
- Sample260801-dnjyeswfpd
- SHA256 6c2f9cef2710a3646d40736b2c601c367c24a3ee8479f09a182c8eba184e3158
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 13 IoCs
- Detects executables containing possible sandbox analysis VM usernames 31 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 8 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 31 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_6e864afcc3d429c0c7c4d6ab35093dfa_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_6e864afcc3d429c0c7c4d6ab35093dfa_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2941.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe10⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46091.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7202.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19694.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59356.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11542.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22189.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24209.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40078.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28289.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36181.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17825.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58513.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28625.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34405.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-12208.exe
Unicorn-12475.exe
Unicorn-14691.exe
Unicorn-15597.exe
Unicorn-21876.exe
Unicorn-22189.exe
Unicorn-2276.exe
Unicorn-23545.exe
Unicorn-23983.exe
Unicorn-24209.exe
Unicorn-26757.exe
Unicorn-3082.exe
Unicorn-3436.exe
Unicorn-34405.exe
Unicorn-35463.exe
Unicorn-36181.exe
Unicorn-36805.exe
Unicorn-37481.exe
Unicorn-40078.exe
Unicorn-45131.exe
Unicorn-45628.exe
Unicorn-46309.exe
Unicorn-46414.exe
Unicorn-47610.exe
Unicorn-50249.exe
Unicorn-50326.exe
Unicorn-50939.exe
Unicorn-52745.exe
Unicorn-57253.exe
Unicorn-6891.exe
Unicorn-8615.exe
memory/1760-630-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1812-319-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2116-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2520-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2980-323-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2992-564-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3404-563-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4224-565-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4396-316-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4696-322-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5004-92-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6088-111-0x0000000000400000-0x0000000000475000-memory.dmp