kinsing | 2ebcf4f6960e5e8186c7310d9617a304dd67aa1e7d2fe022e14f81a8bf322889

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe
Size

35KB
MD5

8d40ba89b33e329fb0ae3e9bbe3b00c3
SHA1

61f3cec5cf20adc1d74d76767cd2813c300978ab
SHA256

2ebcf4f6960e5e8186c7310d9617a304dd67aa1e7d2fe022e14f81a8bf322889
SHA512

621935ca08f7ef95b24e2e005e977e4018a98e3a4b8d8d140789eb5e4f995e5eb3d989ded04e276ce3297681e527a7d5e3338781cb643945cca5e1d167f24944
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXun19:btB9g/WItCSsAGjX7e9N0hunv

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

4012 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4012	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe

description	pid	process	target process
PID 2004 wrote to memory of 4012	2004	2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe	gewos.exe
PID 2004 wrote to memory of 4012	2004	2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe	gewos.exe
PID 2004 wrote to memory of 4012	2004	2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
35KB

MD5
196f12a243a9d38b806db1d4b91aaab3

SHA1
29972ec9a9e1f367441f0bd65ff4ceb4f82495be

SHA256
821bf1101bb8f3e8ba67137be02a98a4d86460e54363fc650a42db588cebfc5a

SHA512
713d32ced02248e56c92deca8f52d69b8e4cf64c039c36c77f768cc5b606466d475d349273154224da0e828f0ffc25307fda2e6806d1276ba640ba7af60eece5

Download Submit
memory/2004-0-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/2004-1-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/2004-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4012-21-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download