8bab13995983e8072027da514a3f8aaea38a4c26400fb63e1f4b855ff9a82971

General

Target

kins_2.0.9.13.vir.exe
Size

249KB
MD5

1d36badcc048ba21a142788f03c2e440
SHA1

22f9faf9d9514dc452610d31019c376eebfd3fb0
SHA256

8bab13995983e8072027da514a3f8aaea38a4c26400fb63e1f4b855ff9a82971
SHA512

b3d517b6c999fb53af2dc5aa29233107c1938a54c918108cfc0372ffa58b2e3865e351b0e196ca54ca8804690c05f9a0f4c6e0637cd7c75f7f3c7ad0e5fc0090

Score

8^/10

evasion persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 106 IoCs

Processes:

kins_2.0.9.13.vir.exekins_2.0.9.13.vir.exeusze.exeusze.exe

description	pid	process	target process
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1508 wrote to memory of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1560 wrote to memory of 1620	1560	kins_2.0.9.13.vir.exe	usze.exe
PID 1560 wrote to memory of 1620	1560	kins_2.0.9.13.vir.exe	usze.exe
PID 1560 wrote to memory of 1620	1560	kins_2.0.9.13.vir.exe	usze.exe
PID 1560 wrote to memory of 1620	1560	kins_2.0.9.13.vir.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 1620 wrote to memory of 760	1620	usze.exe	usze.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1200	760	usze.exe	taskhost.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1280	760	usze.exe	Dwm.exe
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1312	760	usze.exe	Explorer.EXE
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1560	760	usze.exe	kins_2.0.9.13.vir.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 760 wrote to memory of 1128	760	usze.exe	cmd.exe
PID 1560 wrote to memory of 1128	1560	kins_2.0.9.13.vir.exe	cmd.exe
PID 1560 wrote to memory of 1128	1560	kins_2.0.9.13.vir.exe	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

kins_2.0.9.13.vir.exeusze.exe

description	pid	process	target process
PID 1508 set thread context of 1560	1508	kins_2.0.9.13.vir.exe	kins_2.0.9.13.vir.exe
PID 1620 set thread context of 760	1620	usze.exe	usze.exe

Loads dropped DLL 2 IoCs

Processes:

kins_2.0.9.13.vir.exe

pid process

1560 kins_2.0.9.13.vir.exe
1560 kins_2.0.9.13.vir.exe

pid	process
1560	kins_2.0.9.13.vir.exe
1560	kins_2.0.9.13.vir.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

usze.exe

pid	process
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe
760	usze.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1128 cmd.exe

pid	process
1128	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

usze.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run	usze.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\usze.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Orno\\usze.exe"	usze.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

kins_2.0.9.13.vir.exe

description pid process

Token: SeSecurityPrivilege 1560 kins_2.0.9.13.vir.exe
Executes dropped EXE 2 IoCs

Processes:

usze.exeusze.exe

pid process

1620 usze.exe
760 usze.exe

description	pid	process
Token: SeSecurityPrivilege	1560	kins_2.0.9.13.vir.exe

pid	process
1620	usze.exe
760	usze.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

kins_2.0.9.13.vir.exeusze.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE	kins_2.0.9.13.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE	usze.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1200

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1280

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\kins_2.0.9.13.vir.exe
"C:\Users\Admin\AppData\Local\Temp\kins_2.0.9.13.vir.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1508

\??\c:\users\admin\appdata\local\temp\kins_2.0.9.13.vir.exe
"c:\users\admin\appdata\local\temp\kins_2.0.9.13.vir.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Identifies Wine through registry keys
PID:1560

C:\Users\Admin\AppData\Roaming\Orno\usze.exe
"C:\Users\Admin\AppData\Roaming\Orno\usze.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1620

\??\c:\users\admin\appdata\roaming\orno\usze.exe
"c:\users\admin\appdata\roaming\orno\usze.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Executes dropped EXE
- Identifies Wine through registry keys
PID:760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa528101d.bat"
4⤵
- Deletes itself
PID:1128

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1876

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpa528101d.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Orno\usze.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Orno\usze.exe

Download Submit
\??\c:\users\admin\appdata\roaming\orno\usze.exe

Download Submit
\Users\Admin\AppData\Roaming\Orno\usze.exe

Download Submit
\Users\Admin\AppData\Roaming\Orno\usze.exe

Download Submit
memory/760-9-0x000000000040872B-mapping.dmp

Download
memory/1128-12-0x0000000000000000-mapping.dmp

Download
memory/1560-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1560-1-0x000000000040872B-mapping.dmp

Download
memory/1560-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1620-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads