Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 19:51
General
-
Target
kins_1.0.0.1.vir.exe
-
Size
259KB
-
MD5
33b9dcf1237941fd90e28df9ca78c730
-
SHA1
9f40f20d5caa06a39db6448ba477742f58a6a959
-
SHA256
74c975e466910e51d9a87fcffdc408e88df2aef3d8b0a9011faf70015966f013
-
SHA512
463d83e7f175fb5c890f5d0e2cb37cc38fbb88c9b993a96d8836f077be907f0944d3dffad20b464f7bc1a2b3ccc5c9776b46ca6f2a669cbca0c8a41e667436f1
Score
7/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.1.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.1.vir.exe"2⤵
- Identifies Wine through registry keys
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3428-0-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3428-1-0x00000000004196A3-mapping.dmp
-
memory/3428-2-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB