kinsing | 11e6ed26f4442fe15892dde92b7651258e9ae5c10fda711582e2c3c3c9a24eac

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:31

Target

74f98761f8a4c2c148f64a19f31ba63e.exe
Size

754KB
MD5

74f98761f8a4c2c148f64a19f31ba63e
SHA1

5e9aca479fc0f385f1950bd1c535dda777c1083c
SHA256

11e6ed26f4442fe15892dde92b7651258e9ae5c10fda711582e2c3c3c9a24eac
SHA512

f0438e4d53a12ab6cdf0c35941e821eefa1bae43988d6a69797e8bbcd909481acc72f5033c6b27070ba5c5e5c0fc498a7a5b90a84f1a02b2e579aa454b146cd4
SSDEEP

12288:SsqLSiix1vV13me30XpR2/rUOrcbUagbaV2aWwYPvs2O1akJZ81C/wtzOmozJmI:ReSiiDr0Lar1QbUakaV2aDYcT1FJUCVH

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

1996 setup.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2060 1996 WerFault.exe setup.exe

pid	process
1996	setup.exe

pid	pid_target	process	target process
2060	1996	WerFault.exe	setup.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

74f98761f8a4c2c148f64a19f31ba63e.exesetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74f98761f8a4c2c148f64a19f31ba63e.exe

description	pid	process	target process
PID 636 wrote to memory of 1996	636	74f98761f8a4c2c148f64a19f31ba63e.exe	setup.exe
PID 636 wrote to memory of 1996	636	74f98761f8a4c2c148f64a19f31ba63e.exe	setup.exe
PID 636 wrote to memory of 1996	636	74f98761f8a4c2c148f64a19f31ba63e.exe	setup.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 1696
3⤵
- Program crash
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1996 -ip 1996
1⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
277KB

MD5
28172f724b8f51716e35186c06d90ad8

SHA1
486750e2288d8a6426a4b60de8d826023f26a437

SHA256
39505a6c029ca08912be65bb0b88979cd21cd9441bf8c6302dc810e4607ee2e8

SHA512
0fde2e28ee8c4cda3c296898a0cac7c4721daf40a448eb70092c6655ffc83044f51146e5cd57e4150f7658b3ee298e41a89346658b2f815a7096cb5bd343cac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
620KB

MD5
41b7d66c4c016b8a7ce5c35cab3e7319

SHA1
d06454131b300f67a1871a68f40cb432569bdde0

SHA256
72bc2e21ca195da605ddbaad596c91b7d953778e06ac088f1f95d5afea722121

SHA512
4c20abaffc54304ee03168139fe1caf728b8f37f3cc9f0dbb0835c5184b9f40ff7624da0cd80a82138ca6c815bfbfccfd7068a007cb8b2429fa8ac87db576850

Download Submit
memory/636-0-0x0000000000400000-0x000000000066C000-memory.dmp

Filesize
2.4MB

Download
memory/636-1-0x0000000000400000-0x000000000066C000-memory.dmp

Filesize
2.4MB

Download
memory/636-6-0x0000000000400000-0x000000000066C000-memory.dmp

Filesize
2.4MB

Download
memory/1996-7-0x0000000000400000-0x000000000066C000-memory.dmp

Filesize
2.4MB

Download
memory/1996-10-0x0000000000400000-0x000000000066C000-memory.dmp

Filesize
2.4MB

Download