Overview

overview

10

Static

static

10

fc3542b795...6d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/08/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fc3542b7951c6a7380dbf7688fb904f3209060b865850f009bc0e57e6dc6d16d.exe
  • Size 468KB
  • Sample260831-pp53tsvsh1
  • SHA256 fc3542b7951c6a7380dbf7688fb904f3209060b865850f009bc0e57e6dc6d16d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverykawaiiunicorntrojan

Malware Config

Signatures

  • Family: KawaiiUnicorn

    KawaiiUnicorn is a trojan written in Visual Basic.

    trojankawaiiunicorn
  • Detects KawaiiUnicorn 38 IoCs
  • Executes dropped EXE 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc3542b7951c6a7380dbf7688fb904f3209060b865850f009bc0e57e6dc6d16d.exe
    "C:\Users\Admin\AppData\Local\Temp\fc3542b7951c6a7380dbf7688fb904f3209060b865850f009bc0e57e6dc6d16d.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2448
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4472
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2972
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:836
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4636
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2640
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1176
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:4492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Unicorn-20448.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe
        • Size 468KB
        • SHA256 453ce5bf77c53792b4f145b532aa38eeb87d962b96407ec89dab8e6bc189377b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-20876.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        • Size 468KB
        • SHA256 000b97cfb10949ca9ffb567e6b583b003874f09256f5dfaec9cc744244530096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-2567.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        • Size 468KB
        • SHA256 937ca8bf0a2624c2cad64af04bf40e3432394b9e80a0b4a2d9738d18bb3d9490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-29016.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        • Size 468KB
        • SHA256 e93aa223b80b404604ed00100365a479d1f5d314a73f078b74fcc902e7d5455e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-31768.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        • Size 468KB
        • SHA256 fb587232d8dbec83c95462f737c31e1b76ed67c392d9e4e3f431913a63cd3b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-33603.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
        • Size 468KB
        • SHA256 d5a116101d441a72ea1a3038b9abd959e9459e72f880ec00ae63560bbe0923f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-40204.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        • Size 468KB
        • SHA256 5012f32feca1b2a8a61f89018808a33c33358355c173b80d3fef2e2c401503fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-47736.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        • Size 468KB
        • SHA256 1fb1a86c67ae797adff24470c0ad04719fadb438453c67e22d4a972d94c20a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-50292.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        • Size 468KB
        • SHA256 e84d2e5e9b656061e459483f6729aa2b19fe864024336ce5583541e4cf47be8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-50372.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        • Size 468KB
        • SHA256 e03fdd94c79194307353eb826590273b0ca30d640c258502fee275a76f49479b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-61176.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
        • Size 468KB
        • SHA256 e4ffaf0826154a87e5c186502f671e0dd109b0f0fb04b10c1a4f064b20e03e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-7175.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        • Size 468KB
        • SHA256 b91e75fe21e7c0022cd5ca88afbbf9f798799604711c6dcfd46580b33db2835b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/836-95-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/836-56-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/940-0-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/940-87-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1176-77-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1176-98-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2308-28-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2308-91-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2448-21-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2448-90-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2640-70-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2640-97-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2972-49-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2972-94-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3116-89-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3116-13-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4112-88-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4112-6-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4472-93-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4472-41-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4492-83-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4492-99-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4636-63-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4636-96-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/5060-92-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/5060-35-0x0000000000400000-0x0000000000475000-memory.dmp
        Download