Overview

overview

10

Static

static

3

8aec9de403...c2.exe

windows7-x64

1

8aec9de403...c2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 15:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8aec9de403dba8e7110d53f7378eb6b49fae007d60b5d52c2de35e4081aa7dc2.exe

  • Size

    1.1MB

  • MD5

    4b0a006f9b14f6e3070305a61ac40672

  • SHA1

    8d71fb7b6a11e9a91911b65a38850627fcae1326

  • SHA256

    8aec9de403dba8e7110d53f7378eb6b49fae007d60b5d52c2de35e4081aa7dc2

  • SHA512

    40066282d5c77ef746078a5e15f5e35c967cd480d45c53b88b32e3b945fae83fe207003b55dd7219ddec6d589fd0e714a1454dedff02fc07a0a034ad5ab2e6f5

  • SSDEEP

    24576:cmqazIFSFQ5NcQKMfmHYG8ufYQC82TzaoX2xZj5zqa:Fq6IFSFQ5GQK1dZyPed+

Score
10/10
kinsingloader

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8aec9de403dba8e7110d53f7378eb6b49fae007d60b5d52c2de35e4081aa7dc2.exe
    "C:\Users\Admin\AppData\Local\Temp\8aec9de403dba8e7110d53f7378eb6b49fae007d60b5d52c2de35e4081aa7dc2.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2348
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\alg.exe
    Filesize

    448KB

    MD5

    51f7d13e9e8addb2702e9c02cdc5e8c0

    SHA1

    b6e5d409d6872ca58f4a83ec659040f5450d61ce

    SHA256

    822f7f454e55922d1fcb26d2f2bb7499080b51b37b19a4b93fd9c5e868958817

    SHA512

    074ac44480a0c4d12c1957fc2f4f8dd43cdf47bb3007c52cf8cabf0142bfa608684661dd78e31e790d60c9cca4a7ec27a5e54bcd68ecc4763b0ea139cbf03cf1

    Download Submit
  • memory/312-15-0x0000000140000000-0x0000000140281000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/312-16-0x0000000140000000-0x0000000140281000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/2348-0-0x0000000140000000-0x000000014012A000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2348-1-0x0000000000830000-0x0000000000890000-memory.dmp
    Filesize

    384KB

    Download
  • memory/2348-7-0x0000000000830000-0x0000000000890000-memory.dmp
    Filesize

    384KB

    Download
  • memory/2348-11-0x0000000000830000-0x0000000000890000-memory.dmp
    Filesize

    384KB

    Download
  • memory/2348-13-0x0000000140000000-0x000000014012A000-memory.dmp
    Filesize

    1.2MB

    Download