Overview

overview

10

Static

static

10

1f41af4c5b...1c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 21:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1f41af4c5bf33831476e88b4b495dec0e96de461e64a8ba5017df10f335ba91c.exe
  • Size 468KB
  • Sample260916-1ercgaee67
  • SHA256 1f41af4c5bf33831476e88b4b495dec0e96de461e64a8ba5017df10f335ba91c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverykawaiiunicorntrojan

Malware Config

Signatures

  • Family: KawaiiUnicorn

    KawaiiUnicorn is a trojan written in Visual Basic.

    trojankawaiiunicorn
  • Detects KawaiiUnicorn 41 IoCs
  • Executes dropped EXE 13 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f41af4c5bf33831476e88b4b495dec0e96de461e64a8ba5017df10f335ba91c.exe
    "C:\Users\Admin\AppData\Local\Temp\1f41af4c5bf33831476e88b4b495dec0e96de461e64a8ba5017df10f335ba91c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4776
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4276
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-64121.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-64121.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2404
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4404
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1836
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:692
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3808
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3964
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:5068
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:840
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Unicorn-12808.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        • Size 468KB
        • SHA256 b65a3f8451f68652f76848be7b7216ee406216f34e4c1d007018548b62d4232b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-21665.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe
        • Size 468KB
        • SHA256 ed0422888879c2917124d8c2671a98b21a76b0322849501073299b56f09644da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-2170.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
        • Size 468KB
        • SHA256 69e5ce244f9a403a84d05d98adc1e0d4278efb76ebec3f510351eee51b46bfb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-29589.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        • Size 468KB
        • SHA256 b4d1091bf3652a10d5edacd4ccdf8470a92983ec650bd75ee3c4ba9eaaf03342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-34381.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34381.exe
        • Size 468KB
        • SHA256 d7874cc4de7a266a8fcc8e1b4a24d71cef1cfc591dd1dede4d5ac171ce6b1ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-34659.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        • Size 468KB
        • SHA256 547c41b6fad932a6d9e666af81198385f875efaec026e8abe8be89e9b7f22a3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-4150.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe
        • Size 468KB
        • SHA256 8e073c6d0262ec1f8b3028b07d2f91f09384bb0b0df74c9d63a78e25e281914b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-42269.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        • Size 468KB
        • SHA256 3b7ae856fa2d832c878ccf90535b41e267baf17c69f1a01c0b9725c63bbfb269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-51615.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        • Size 468KB
        • SHA256 d646d3c592441a49794e7822a1e501aae49c4f612c204454a5de1074baa00ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-64121.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64121.exe
        • Size 468KB
        • SHA256 a604c1b515426fabc8ea54801e996a380ed6e53d6c813b4c958aadc30ec3cb83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-64365.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        • Size 468KB
        • SHA256 e7d3c82d12db7a977117c3e849e3b2ef49b131a43fa6b7e646baf923397d67cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-6472.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        • Size 468KB
        • SHA256 88c645261b491dac60e39764459e89edf0ec7b53024bdc1fd07201ed0cd73dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unicorn-7982.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        • Size 468KB
        • SHA256 3c49e42cce69dab98a4bb55fd73b31e3470acfb2c8dafb9ff2f82a6f805d1ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/692-55-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/692-101-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/840-105-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/840-83-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1660-95-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1660-13-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1836-48-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1836-100-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1944-92-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/1944-90-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2404-35-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/2404-98-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3232-93-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3232-0-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3540-6-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3540-94-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3808-62-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3808-102-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3964-69-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/3964-103-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4276-97-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4276-28-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4404-99-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4404-41-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4776-21-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/4776-96-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/5068-76-0x0000000000400000-0x0000000000475000-memory.dmp
        Download

        memory/5068-104-0x0000000000400000-0x0000000000475000-memory.dmp
        Download