kinsing | 7a33ac75ed6e9ae38c707987f28e67ca5b2ab1a02aedeb757fc9981b9f78843d

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe
Size

60KB
MD5

894384ba4efb6c7087d49107a0dfed31
SHA1

fb87efeaf67144f425ecb65eb52afae2b286f7b5
SHA256

7a33ac75ed6e9ae38c707987f28e67ca5b2ab1a02aedeb757fc9981b9f78843d
SHA512

914d6e635cba83b978a0d9383d7b6226f4003f97d366aa82397b24a30fe639a017731d59c47e01092b309edb530b2b880223510d70218a8a0e22b1f05d7576ef
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCY8EQMjpi/Wpi3B3URiLnuoUwUsfqB16:vj+jsMQMOtEvwDpj5Hy7B3gG8xzUn

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2528 misid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2528	misid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe

description	pid	process	target process
PID 4400 wrote to memory of 2528	4400	2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe	misid.exe
PID 4400 wrote to memory of 2528	4400	2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe	misid.exe
PID 4400 wrote to memory of 2528	4400	2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_894384ba4efb6c7087d49107a0dfed31_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4400

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
60KB

MD5
f328d2f300b24d9d7f694386c8763b9e

SHA1
36dc2aef50e51a61066baad53932a74a3fd8f64d

SHA256
08ba0c10de272d00540fc30a4c9db9587575ab6a7c5ccc49f57385a5a3bf6033

SHA512
c883b954079f4ec8d65c00d232d7b3c6d6fc8f20532b3d7f9a93807342eca3caeef4f4603ba85815d7686cc1845efc38df88d76c7d417b41d684d0e5e9e320bf

Download Submit
memory/2528-17-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2528-18-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/4400-0-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4400-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4400-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download