Overview

overview

10

Static

static

1

microsofti...1).rtf

windows7-x64

10

microsofti...1).rtf

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    microsoftinteroirdesignsectiontocompleteentireprocesstodevelopthenewsystemtechnologytounderstand (1).doc

  • Size

    64KB

  • Sample

    240125-s3g5psagfr

  • MD5

    eaf57752e189fbdb0894a43ed390efe6

  • SHA1

    14b2ad64c23a473469560bdcaac2ef47c0fa544b

  • SHA256

    1de402b1aa5fcf8a3782a2656b75dd8e943b68e181acc45ef85b32df95f2b640

  • SHA512

    e0fe29cbb93dda62ee689712f83ac5043eb93e9372f2e64c23e1e42b0e6e8e2fd81334697793a755b30f2f0f70d8b685eea24507a750f28909437a6b4d1481d6

  • SSDEEP

    1536:oKxmiZJ0gYNb7MFKfoZyXvjz2catCKVJkfEKSl:x1BFTZ2CgKVJkMKa

Score
10/10
kinsingloader

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://wallpapercave.com/uwp/uwp4241942.png
exe.dropper

https://wallpapercave.com/uwp/uwp4241942.png

Targets

    • Target

      microsoftinteroirdesignsectiontocompleteentireprocesstodevelopthenewsystemtechnologytounderstand (1).doc

    • Size

      64KB

    • MD5

      eaf57752e189fbdb0894a43ed390efe6

    • SHA1

      14b2ad64c23a473469560bdcaac2ef47c0fa544b

    • SHA256

      1de402b1aa5fcf8a3782a2656b75dd8e943b68e181acc45ef85b32df95f2b640

    • SHA512

      e0fe29cbb93dda62ee689712f83ac5043eb93e9372f2e64c23e1e42b0e6e8e2fd81334697793a755b30f2f0f70d8b685eea24507a750f28909437a6b4d1481d6

    • SSDEEP

      1536:oKxmiZJ0gYNb7MFKfoZyXvjz2catCKVJkfEKSl:x1BFTZ2CgKVJkMKa

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Blocklisted process makes network request

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks