kinsing | 3c7e20476d3297f74f1ea9cfd055454a9c627f4ef26236d955127748323071d5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe
Size

67KB
MD5

52f0c5472cd307ab7e04b44ca314da89
SHA1

e9e8aafb156d20ec73554ee0aae75a0e49717a0c
SHA256

3c7e20476d3297f74f1ea9cfd055454a9c627f4ef26236d955127748323071d5
SHA512

1730de471bbb2ff58ac251d77657ce984625f7d89692dff319bdeebba51cc8b85a5b8f279f4c82c7e327bd60c0b91ae6dbfd9be2d7579dc536dbba740fe02671
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU9:DW60sllyWOtEvwDpjwF85j

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4888-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/4888-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4888-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/4888-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2252 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2252	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe

description	pid	process	target process
PID 4888 wrote to memory of 2252	4888	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe
PID 4888 wrote to memory of 2252	4888	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe
PID 4888 wrote to memory of 2252	4888	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4888

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
68KB

MD5
932e58a6393803d93ac9918adc0cc976

SHA1
01cd342ce1c803e92a96d64e0af6b94c59617f5b

SHA256
37015f10c70a6a0a29d005f843dd2a50be2e5202ab26213895ce97dcdec89097

SHA512
3e746088267722f16b16ec7ddb4e45ce61e93036efacafb510cc64e0f96b8789d33837060da7c095fc7acb7c902fe5a90d199b9483fdb29bc00f7282a71256ba

Download Submit
memory/2252-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2252-25-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4888-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4888-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4888-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4888-3-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/4888-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download