kawaiiunicorn | 114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134.exe
Size 468KB
Sample260916-yctnpsfj21
SHA256 114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134
MD5 04499d97da51071ef82b3ec405dd9481
SHA1 634c94dbf05aa1b3082d4f02f5cccb888929adf2
SHA512 1cc34bb4f6d3e379a898d834fce5e9a0c0e403cfdf87fc85f6512e655ea6b3ce669bfc286ec99c1f39ae85304f1ad0bcd2ef77ebf0bc0a897a3db06d5fc76406
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKL65kpkNWXSgnSU7MvlWVfELlp:XEzVm7fEDPw0/EhOvASU7qYVfE
TLSH
T1A2A4A5929C64AF45FE16453423956EBA004E7D2F66E4422C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 53 IoCs

resource	yara_rule
behavioral1/memory/3316-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000500000002325d-5.dat	family_kawaiiunicorn
behavioral1/memory/1788-7-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3316-10-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000c0000000243dd-13.dat	family_kawaiiunicorn
behavioral1/memory/4676-15-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1788-18-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000e0000000243e0-19.dat	family_kawaiiunicorn
behavioral1/memory/4296-23-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4676-26-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00100000000243e1-29.dat	family_kawaiiunicorn
behavioral1/memory/1120-30-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4296-34-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00110000000243e2-37.dat	family_kawaiiunicorn
behavioral1/memory/3240-39-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1120-42-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00130000000243e3-45.dat	family_kawaiiunicorn
behavioral1/memory/720-47-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3240-50-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00150000000243e4-53.dat	family_kawaiiunicorn
behavioral1/memory/4168-55-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/720-58-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00170000000243e5-61.dat	family_kawaiiunicorn
behavioral1/memory/2532-63-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4168-66-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00190000000243e6-69.dat	family_kawaiiunicorn
behavioral1/memory/2852-71-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2532-74-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243e7-77.dat	family_kawaiiunicorn
behavioral1/memory/116-79-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2852-82-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243e8-85.dat	family_kawaiiunicorn
behavioral1/memory/1436-87-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/116-90-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243e9-93.dat	family_kawaiiunicorn
behavioral1/memory/2068-95-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1436-98-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243ea-101.dat	family_kawaiiunicorn
behavioral1/memory/952-103-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2068-106-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243eb-109.dat	family_kawaiiunicorn
behavioral1/memory/3020-111-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/952-114-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243ec-117.dat	family_kawaiiunicorn
behavioral1/memory/3180-119-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3020-122-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243ed-125.dat	family_kawaiiunicorn
behavioral1/memory/1640-127-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3180-130-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x001b0000000243ee-133.dat	family_kawaiiunicorn
behavioral1/memory/760-135-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/760-136-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1640-137-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn

Executes dropped EXE 17 IoCs

pid	Process
1788	Unicorn-1088.exe
4676	Unicorn-4186.exe
4296	Unicorn-59199.exe
1120	Unicorn-62297.exe
3240	Unicorn-65395.exe
720	Unicorn-22163.exe
4168	Unicorn-8732.exe
2532	Unicorn-46641.exe
2852	Unicorn-50507.exe
116	Unicorn-18795.exe
1436	Unicorn-32067.exe
2068	Unicorn-35933.exe
952	Unicorn-39031.exe
3020	Unicorn-48351.exe
3180	Unicorn-55533.exe
1640	Unicorn-51195.exe
760	Unicorn-29597.exe

Program crash 17 IoCs

pid	pid_target	Process	procid_target
2368	3316	WerFault.exe	83
3808	1788	WerFault.exe	84
1052	4676	WerFault.exe	88
4584	4296	WerFault.exe	91
1420	1120	WerFault.exe	94
3212	3240	WerFault.exe	97
1040	720	WerFault.exe	100
1648	4168	WerFault.exe	103
2188	2532	WerFault.exe	106
1484	2852	WerFault.exe	109
4056	116	WerFault.exe	112
4484	1436	WerFault.exe	115
3944	2068	WerFault.exe	118
3848	952	WerFault.exe	121
3644	3020	WerFault.exe	124
980	3180	WerFault.exe	127
3380	1640	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18795.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3316	114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134.exe
1788	Unicorn-1088.exe
4676	Unicorn-4186.exe
4296	Unicorn-59199.exe
1120	Unicorn-62297.exe
3240	Unicorn-65395.exe
720	Unicorn-22163.exe
4168	Unicorn-8732.exe
2532	Unicorn-46641.exe
2852	Unicorn-50507.exe
116	Unicorn-18795.exe
1436	Unicorn-32067.exe
2068	Unicorn-35933.exe
952	Unicorn-39031.exe
3020	Unicorn-48351.exe
3180	Unicorn-55533.exe
1640	Unicorn-51195.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1788	3316	114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134.exe	84
PID 1788 wrote to memory of 4676	1788	Unicorn-1088.exe	88
PID 4676 wrote to memory of 4296	4676	Unicorn-4186.exe	91
PID 4296 wrote to memory of 1120	4296	Unicorn-59199.exe	94
PID 1120 wrote to memory of 3240	1120	Unicorn-62297.exe	97
PID 3240 wrote to memory of 720	3240	Unicorn-65395.exe	100
PID 720 wrote to memory of 4168	720	Unicorn-22163.exe	103
PID 4168 wrote to memory of 2532	4168	Unicorn-8732.exe	106
PID 2532 wrote to memory of 2852	2532	Unicorn-46641.exe	109
PID 2852 wrote to memory of 116	2852	Unicorn-50507.exe	112
PID 116 wrote to memory of 1436	116	Unicorn-18795.exe	115
PID 1436 wrote to memory of 2068	1436	Unicorn-32067.exe	118
PID 2068 wrote to memory of 952	2068	Unicorn-35933.exe	121
PID 952 wrote to memory of 3020	952	Unicorn-39031.exe	124
PID 3020 wrote to memory of 3180	3020	Unicorn-48351.exe	127
PID 3180 wrote to memory of 1640	3180	Unicorn-55533.exe	130
PID 1640 wrote to memory of 760	1640	Unicorn-51195.exe	133

C:\Users\Admin\AppData\Local\Temp\114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134.exe
"C:\Users\Admin\AppData\Local\Temp\114b258ce9c00270a89c9275e4278ea7e9c31b8f5702f60689f0ac73ed3e0134.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 744
        18⤵
        Program crash
        
        PID:3380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 724
        17⤵
        Program crash
        
        PID:980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 716
        16⤵
        Program crash
        
        PID:3644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 716
        15⤵
        Program crash
        
        PID:3848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 744
        14⤵
        Program crash
        
        PID:3944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 724
        13⤵
        Program crash
        
        PID:4484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 740
        12⤵
        Program crash
        
        PID:4056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 740
        11⤵
        Program crash
        
        PID:1484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 724
        10⤵
        Program crash
        
        PID:2188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 712
        9⤵
        Program crash
        
        PID:1648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 724
        8⤵
        Program crash
        
        PID:1040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 724
        7⤵
        Program crash
        
        PID:3212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 724
        6⤵
        Program crash
        
        PID:1420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 740
        5⤵
        Program crash
        
        PID:4584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 752
      4⤵
      Program crash
      PID:1052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 724
    3⤵
    - Program crash
    PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 744
  2⤵
  - Program crash
  PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3316 -ip 3316
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1788 -ip 1788
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4676 -ip 4676
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4296 -ip 4296
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1120 -ip 1120
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3240 -ip 3240
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 720 -ip 720
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4168 -ip 4168
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2532 -ip 2532
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2852 -ip 2852
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 116 -ip 116
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1436 -ip 1436
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2068 -ip 2068
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 952 -ip 952
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3020 -ip 3020
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3180 -ip 3180
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1640 -ip 1640
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-1088.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
Size 468KB
SHA256 700c633fa5f978355de3415f51b59ad498abc93df6d51a8d2bc3c3a0c68e8cc3
MD5 857facf353c1e439f63503d1c02bf297
SHA1 c723b50f637843c4179534cd36bd727e9572ea72
SHA512 a1e6a10a0fe05781246e394a54eef8fbc50fd2f3a7f23d4eb983c2d13c03afe93a721b08a95a644326bfcbc4f1647200042e895a5bd64ab5d699e154cde337cd
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKL65kpkNWXSgnSU7MvlWVfELl0:XEzVm7fEDPw0/EhOvASU7qYVfE
TLSH
T139A4A5929C64AF45FE16453423956EBA004E7D2F66E4422C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18795.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
Size 468KB
SHA256 2e5a01f04c77252afb4d9b475276386e9cd9de03f55742000e79a0f3c0ebb046
MD5 b128a88bc74a9319ac00402f41b3f2e1
SHA1 4500552d91177eb4f1c21942dd9b50793113d844
SHA512 30dce52c8c53b813c5a417d58664956702eee54941f29cfa2ebf3c84059e25c35ceea7c81563cf7705f75de75839d54a8cea168e3823c688851b465358a53dca
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnSU7Mv9FVfEAlj:XEJVm7fEDPw0/EptvASU7qbVfE
TLSH
T161A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22163.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
Size 468KB
SHA256 eca26258f7221e514e2bf26741ec235b7554ec53f85ba696585d12a0b4720d4a
MD5 b3e54c06713a030f743e59de829a362a
SHA1 f8d2ab299884cb4e28cdd284edcf6622c65cd945
SHA512 9862d166b68c236f40dbef431d061cb1635ad89a253699f567d4381cff2ea1bc43d6b585c834147d2d2643e99195befbad1b4ad1bf6e06105793e0c4f43f59e2
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKm65kpkNWXSgnSU7MvlWVfEAlj:XEzVm7fEDPw0/EhtvASU7qYVfE
TLSH
T1DFA4A5929C64AF45FE16453423956EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29597.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
Size 468KB
SHA256 02c475cb982bf4f48c3b9a7e59e378f1ed4cfb92cd81c56bb9e80a6e10fcd8f5
MD5 0424e0e1428a9c10bcef9f0e41a0917d
SHA1 3e4f85cd6a0b5facd5d2b4859abbcef0dae7794c
SHA512 21df804b3b46bd218efc6d97f26373ee233a1579d0bf51b121bac3ad27143ea533dc894d5a6dde3231fcd5456d0470510f3bf5d16ec423b07e61650dc82c6947
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXS8nGB7KvuFdfEAlj:XEJVm7fEDPw0/EptvcGB7USdfE
TLSH
T11CA4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32067.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32067.exe
Size 468KB
SHA256 c904cc2d476475b7146c34a827c13f1159695fa7076717bbf2c4de21f255131a
MD5 79732e964ed5eaaeabecaf30668496be
SHA1 e00cb326271326aa45ee183ea5a0b67d181c7af6
SHA512 d999049c926248d126616b5e78b5736a8773e498fbc338f6905e042b0218d9e033b0ddb07117118a52837552242e777b767759688ab0e67f1810f41824ef24cb
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnGU7Mv9FVfEAlj:XEJVm7fEDPw0/EptvAGU7qbVfE
TLSH
T114A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35933.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
Size 468KB
SHA256 f934a2aca1f3deb327935bc13e1801083d798af2aad550bf3cb68366c375c153
MD5 f583cc80ddf4dad9057c59067e3ceeeb
SHA1 fc11de971826f99536ece1d5108f912531795441
SHA512 8ac0f0a2dcdd913cdec7f0c3ebb2fb3c327fc5fb66f8d5b2989c595e59e4c95cad495cf4a0988e4ebc342b24cba0cbb0996a113b9c859b9f8dfb22d2ce67413b
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnGB7Mv9FVfEAlj:XEJVm7fEDPw0/EptvAGB7qbVfE
TLSH
T111A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39031.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
Size 468KB
SHA256 dfc124626624bd549dccfe6a146b96dbc787328a9f638be9a299cbf99cbda236
MD5 504618c0b1ed2d98572689cb0c0c953a
SHA1 fa279627b0920a0fae78e994140eb5449afe72ba
SHA512 421e72a700c7c2b501216d81268e057d4d5e3764a66f1991588bd6a62bb460f5d9d0e6a79d9dcf150195d0cff917dd42473c7cba9f2c079036ee41e1ec935db7
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnGB7Kv9FVfEAlj:XEJVm7fEDPw0/EptvAGB7UbVfE
TLSH
T136A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4186.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
Size 468KB
SHA256 49903037992be8cea67046467b793bc578b530abbe79909eed2723662bb20ef9
MD5 605a16c50c9b45bce42656db538767fb
SHA1 e5e762b3e698aede22e24874872c769b1174c69e
SHA512 0a1f27bad91016d3792c3f45c6109d8a67b70d5b511774f55add87b0999f521cc425280b1455af7d3173a6d84a547d2d8d6438d387a324877a8753cdb52179f3
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKL65kpkNWXSgnSU7MvlWVfELlp:XEzVm7fEDPw0/EhOvASU7qYVfE
TLSH
T113A4A5929C64AF45FE16453423956EBA004E7D2F66E4422C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46641.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
Size 468KB
SHA256 e8871331cd4caa928a745acc89fb7b18784f0bfbb4a4ac1b6a19106f878b6e0e
MD5 1758d8f1da7b56deb6da5b95266433b6
SHA1 6f58fa74f279706992db6e9d0f02d47fd1345aed
SHA512 6fe93bff4dd70b42e3a59d810cce398b1e5f7b08f150e8b6a20513648e8dd069007568ac2968ff6d0107c3fa9c6bbb775dc310b8e54eb0f404334355084ae836
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nKNuYKm65kpkNWXSgnSU7Mv9WVfEAlj:XEJVm7fEDPw0/EhtvASU7qgVfE
TLSH
T170A4A5929C64AF45FE16453423956EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48351.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
Size 468KB
SHA256 81bfb948d07ce83c7e2d106369e0b6f39f3b0a3c1fb5f713e07665bfbf113231
MD5 b9141c2a59df178aa76c110e790a4860
SHA1 501e8a618cfebbec3c4d4b4817b7b83ff9698868
SHA512 b7dcbb3397ae45b9db528dd5ecce7439c7f528a9fe0d2a54b24b7d454078d7df68362b0ab39ebcc9ef67a5f8eb820f2f30ef781bd8884b376c161b878db0cc71
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnGB7KvuFVfEAlj:XEJVm7fEDPw0/EptvAGB7USVfE
TLSH
T167A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50507.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
Size 468KB
SHA256 45d9c2aad46e45601986631edbcc6f5cd2a3b1cf0f0045909b3c1302d8451885
MD5 2b89567cec1d12396c5bfbe2cef84251
SHA1 63229315cec6f9cd15fa4ba44738006c15709fed
SHA512 ecdeabcb7072455c905c1ff6274987e2d0353602d5d2bef94557fd8cb645db78ba9f4f9e2a0769a68f5d0b447a1a7a0fae4501e2add71e6791b10599aa9dba97
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nKNuYKm65kpkNWXSgnSU7Mv9FVfEAlj:XEJVm7fEDPw0/EhtvASU7qbVfE
TLSH
T1D7A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51195.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
Size 468KB
SHA256 ad41af5182ae499f30d8b51166b1b0f1502ab42e070298965b914076e164a2f9
MD5 7af5386b7480cce34c49a38ec7eb6139
SHA1 7082f3052d3516cb813c190ca2c0c4930284a499
SHA512 f8722707e74d40d7f983b0d3beb3ef5704f4a5c01cceb34a096098b259235ceec7c2e49ef0dd6dae4726da614f2de4e1a2c51a2a9538ec50376a0492f6d0e987
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnGB7KvuFdfEAlj:XEJVm7fEDPw0/EptvAGB7USdfE
TLSH
T1B7A4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55533.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
Size 468KB
SHA256 1af8702301c46117b6c1150541140b6e435ce5a41395d88548525d033229e62f
MD5 dfe9d5ae202c9e80201df4551f413e8a
SHA1 76a7345c65833d8983836e394ade4aaf2204ee6f
SHA512 b60e5e0161f80f9bf7d0fc15f0ac8e09f96431fc252a1ae38e05007df5d835340857b79aea1721a3a6df61caf0f720f0f5cc0748dd2638bab581cc55d2a58c32
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nCNuYKm65kpkNWXSgnGB7KvuF1fEAlj:XEJVm7fEDPw0/EptvAGB7US1fE
TLSH
T10AA4A5929C64AF45FE16453423A56EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59199.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
Size 468KB
SHA256 c5bd5a05e023fa45c198cbc0aeffa324dbd1ea282bd29d038c0f9acc9f1b1640
MD5 13bf05cca2a20009fde2b9e3b7f47f50
SHA1 f80999045e889360af7611f09d55b37aa05e2fe5
SHA512 0196938fb7c61d03715ae5cdb7036637279c870b89bf3b96a759bf37a05adff75a29aeb013bf3ab3693e88860a9a4b8d36fa3e58972539240eb03606930ec00f
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKL65kpkNWXSgnSU7MvlWVfEjlp:XEzVm7fEDPw0/EhOvASU7qYVfE
TLSH
T108A4A5929C64AF45FE16453423956EBA004E7D2F66E4422C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62297.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
Size 468KB
SHA256 1d3705654692c04a16e8bd78af0305482d28cbd8f829d420188c630864fa5723
MD5 1cdea378b2420343bbdca86c88d4cfde
SHA1 9581f98958e80892d4988bcc82d42fdd30738964
SHA512 d323e24853c092edae54ad545bd092b510ae3922eb956ac8f68e7276eb59962f9e3ee73217f931fa3fb27a6675fc8a5ce809c4f240b44b310b0c4679eae8c6b0
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKL65kpkNWXSgnSU7MvlWVfEAlp:XEzVm7fEDPw0/EhOvASU7qYVfE
TLSH
T114A4A5929C64AF45FE16453423956EBA004E7D2F66E4422C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-65395.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
Size 468KB
SHA256 657b1b517e39a9d8c6eb17a8fcc4073a76d635b25644ce6d51c0de22243c8aa4
MD5 1197f708892d2057ee3619c4909c0749
SHA1 6bc03d3a29fb30a0652cddd102f6809d32570977
SHA512 e7bd14ae1d8a061e5f4656f103c10d42ee66760e08ffe3946d543cf09909f1b45c19c1caffc32a760968b2d27b324bb20de8af1b39b14d454f0f6a33476578e6
SSDEEP 3072:XEieVbyFRC8fELp5PCv0mIE5nKNuYKL65kpkNWXSgnSU7MvlWVfEAlj:XEzVm7fEDPw0/EhOvASU7qYVfE
TLSH
T1CEA4A5929C64AF45FE16453423956EBA004E7D2F66E4422C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8732.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
Size 468KB
SHA256 636dd6074619a97e56e5337c797a79446541912f96e1fe7cb3d0c99f88db9630
MD5 8fd01e2abadafd779993e14e2fdc14b8
SHA1 08c8b1fbe2e9e3a12f47ad40c24479facaf94ab4
SHA512 54f2a0f0fc5e78d896585c972f719ef8eddcb87de8dc712695fe84ffefb2e8aa5d6c2f6274ac79aba62868d2b6a64739d7f5eb40bad16ace1636b313b2867ddd
SSDEEP 3072:XEisVbyFRC8fELp5PCv0mIE5nKNuYKm65kpkNWXSgnSU7MvlWVfEAlj:XEJVm7fEDPw0/EhtvASU7qYVfE
TLSH
T1BDA4A5929C64AF45FE16453423956EBA004E7D2F66E4421C785DFA0B337399B30AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-79-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/116-90-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/720-58-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/720-47-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/760-135-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/760-136-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/952-114-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/952-103-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1120-42-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1120-30-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1436-98-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1436-87-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1640-127-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1640-137-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1788-18-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1788-7-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2068-95-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2068-106-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2532-74-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2532-63-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2852-71-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2852-82-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3020-111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3020-122-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3180-119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3180-130-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3240-50-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3240-39-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3316-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3316-10-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4168-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4168-66-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4296-34-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4296-23-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4676-26-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4676-15-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads