Overview

overview

10

Static

static

3

2024-01-25...ia.exe

windows7-x64

7

2024-01-25...ia.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-01-25_b463b557f99d15b7c8001004aac37d70_mafia.exe
  • Size 384KB
  • Sample240125-s8dpgaahep
  • SHA256 7265e2d8349169db79d361c635a9c57693ae9f2856a27760d15d8988d188f303
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kinsingloader

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-25_b463b557f99d15b7c8001004aac37d70_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-25_b463b557f99d15b7c8001004aac37d70_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\780E.tmp
      "C:\Users\Admin\AppData\Local\Temp\780E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-25_b463b557f99d15b7c8001004aac37d70_mafia.exe 7F41BE331A8EC2904CEAAE146F5002B1AB544E899ED01BCD4B10E51A393DBF4B2DAA6B506501D116FFC826B2250BFA4CF0EF4841DCE4138D4B78F77AB1976ABD
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2568

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        780E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\780E.tmp
        • Size 384KB
        • SHA256 7251392e0c3b587e576d8ee72af2e8623d5b55a9b0dcc46abe204c8e916913e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download