kinsing | 7663f3de526cdb52b869fd288b53ae297db3e616988bb8ec5f1c5505157a30f9

Analysis

max time kernel
88s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe
Size

97KB
MD5

5607a407a6cc703ab6aba2758bfc8afe
SHA1

6e15a59455b34ecaca72d718a59c7b1c9f7c192a
SHA256

7663f3de526cdb52b869fd288b53ae297db3e616988bb8ec5f1c5505157a30f9
SHA512

3dcc442551d9c3fa65e2eb55a52de31c6cb74582988d21fa78d664f54f5f2ef7b0b8db2d87627a689864b931a1901c9f2877d433c3f80f878a96bf5afa985e7a
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjuvQx:zCsanOtEvwDpjS

Score

10^/10

kinsing loader upx

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1872-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral2/memory/1872-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4388-54-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1872-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral2/memory/1872-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4388-54-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1872-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\misid.exe	UPX
behavioral2/memory/1872-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/4388-54-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

4388 misid.exe

pid	process
4388	misid.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1872-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\misid.exe	upx
behavioral2/memory/1872-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4388-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe

description	pid	process	target process
PID 1872 wrote to memory of 4388	1872	2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe	misid.exe
PID 1872 wrote to memory of 4388	1872	2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe	misid.exe
PID 1872 wrote to memory of 4388	1872	2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5607a407a6cc703ab6aba2758bfc8afe_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
97KB

MD5
1d815cc259a2589234785e9a29c10788

SHA1
a3c730f087263b839e5f844efb1e3a41e59f9850

SHA256
8847a5752b00ed5b026b7e2f5997e639b3f895f3d6fc2e784cefa9b6a1ef1f0e

SHA512
9ba062ab10137dc3118f409e343d9fc40304a530a56ef77155434fbb11e6c867d047bc027386393290f91bd885cc52a9a4ef27d832cf4877f9cbecee75f183c7

Download Submit
memory/1872-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1872-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1872-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1872-3-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/1872-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4388-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4388-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/4388-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download