kinsing | e037ecfeed98a9c21d08fca695fd9dc199d684f6ee343c25b42c0db21f2c9054

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe
Size

73KB
MD5

5a8cbdca041d93444b838adff9073349
SHA1

e1dc0efe2da0250211e8772082445d16f374a48a
SHA256

e037ecfeed98a9c21d08fca695fd9dc199d684f6ee343c25b42c0db21f2c9054
SHA512

6b82168329c33cfe06373769e499af4d5e911e1f4745bb99bec09deb41bdac72aee17661d6d6b1a7cbe3f9d925198bfaaca22fe09aed5529bcbf415f02432c88
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1sdI:X6a+SOtEvwDpjBZYvQd2R

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

4920 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4920	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe

description	pid	process	target process
PID 4268 wrote to memory of 4920	4268	2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe	asih.exe
PID 4268 wrote to memory of 4920	4268	2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe	asih.exe
PID 4268 wrote to memory of 4920	4268	2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5a8cbdca041d93444b838adff9073349_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
73KB

MD5
7844c8a293ddf5955e2ac864a665ed00

SHA1
283f3cfb9c6a85e7c3bd735fa22e509ae06356f3

SHA256
847209f298d65e641441dfff77dda9d8fb77163c058ea55433b4614deba09228

SHA512
e8add8fadf786359cf3f0b940ca8edc74fa513497dfd195596fe061341b96a907fac5dd5e2e922d848a5d5d7194d9fe2d6b8e9b1b1e1bf4e6369f8016cf11734

Download Submit
memory/4268-0-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4268-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4268-2-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4920-20-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4920-17-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download