798c6be4ea73c2d7c936f0d86b804b636188f249fd813f62722565923c158e0b

Analysis

Target

kins_3.1.0.0.vir.exe
Size

213KB
MD5

23877e74b44452778b56855cdf83d9b9
SHA1

4790c8147c74f199481e792493c43ffd1f823e5f
SHA256

798c6be4ea73c2d7c936f0d86b804b636188f249fd813f62722565923c158e0b
SHA512

cdd6af8e94e7739d4d2d5e0f566da2da94b4a9415bf709a08154a269761f701462d557e2cb79f87ad0cbe25ef6a6e399295dd4c42ed96d2d0ed02f8cfcac5237

Score

8^/10

spyware

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

kins_3.1.0.0.vir.exe

description pid process

Token: SeSecurityPrivilege 1820 kins_3.1.0.0.vir.exe
Token: SeSecurityPrivilege 1820 kins_3.1.0.0.vir.exe

description	pid	process
Token: SeSecurityPrivilege	1820	kins_3.1.0.0.vir.exe
Token: SeSecurityPrivilege	1820	kins_3.1.0.0.vir.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

kins_3.1.0.0.vir.exeWaitSuspend.exe

description	pid	process	target process
PID 1820 wrote to memory of 2136	1820	kins_3.1.0.0.vir.exe	WaitSuspend.exe
PID 1820 wrote to memory of 2136	1820	kins_3.1.0.0.vir.exe	WaitSuspend.exe
PID 1820 wrote to memory of 2136	1820	kins_3.1.0.0.vir.exe	WaitSuspend.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe
PID 2136 wrote to memory of 3656	2136	WaitSuspend.exe	explorer.exe

Executes dropped EXE 1 IoCs

Processes:

WaitSuspend.exe

pid process

2136 WaitSuspend.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WaitSuspend.exe

pid process

2136 WaitSuspend.exe
2136 WaitSuspend.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2136	WaitSuspend.exe

pid	process
2136	WaitSuspend.exe
2136	WaitSuspend.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ah406040.default-release\storage\WaitSuspend.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ah406040.default-release\storage\WaitSuspend.exe

Download Submit
memory/2136-0-0x0000000000000000-mapping.dmp

Download
memory/3656-3-0x0000000000000000-mapping.dmp

Download