kinsing | ff47854734fdff34d342d851cd90bef5f0a9b8fc3af8d45ffe56daf1d90ecf93

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:31

Target

74f9bd0eb5c9c650acf5f3823a77c8f4.exe
Size

82KB
MD5

74f9bd0eb5c9c650acf5f3823a77c8f4
SHA1

b2e3a14315ee75be70c8163d0d73208d23c91d6a
SHA256

ff47854734fdff34d342d851cd90bef5f0a9b8fc3af8d45ffe56daf1d90ecf93
SHA512

bf95848f240f1d7e546b2b7004a7e9d5ae91d5e6b1486846ca4843e080e87525714ac7c3cd66a90de5c65ca2889cae712cca1c83edc2f36d95a6131b1b3cca9f
SSDEEP

1536:V5k3lLpvvUeyN1QKSi7Buydt+HtYMX+2C/rSyCPY96Dg7vbJH5eoQfhlIK:V5k3lLpv8ek1QKFeNO2YwE7vbJZrQJlf

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid process

3816 74f9bd0eb5c9c650acf5f3823a77c8f4.exe
Executes dropped EXE 1 IoCs

Processes:

74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid process

3816 74f9bd0eb5c9c650acf5f3823a77c8f4.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid process

1552 74f9bd0eb5c9c650acf5f3823a77c8f4.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

74f9bd0eb5c9c650acf5f3823a77c8f4.exe74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid process

1552 74f9bd0eb5c9c650acf5f3823a77c8f4.exe
3816 74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid	process
3816	74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid	process
3816	74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid	process
1552	74f9bd0eb5c9c650acf5f3823a77c8f4.exe

pid	process
1552	74f9bd0eb5c9c650acf5f3823a77c8f4.exe
3816	74f9bd0eb5c9c650acf5f3823a77c8f4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74f9bd0eb5c9c650acf5f3823a77c8f4.exe

description	pid	process	target process
PID 1552 wrote to memory of 3816	1552	74f9bd0eb5c9c650acf5f3823a77c8f4.exe	74f9bd0eb5c9c650acf5f3823a77c8f4.exe
PID 1552 wrote to memory of 3816	1552	74f9bd0eb5c9c650acf5f3823a77c8f4.exe	74f9bd0eb5c9c650acf5f3823a77c8f4.exe
PID 1552 wrote to memory of 3816	1552	74f9bd0eb5c9c650acf5f3823a77c8f4.exe	74f9bd0eb5c9c650acf5f3823a77c8f4.exe

C:\Users\Admin\AppData\Local\Temp\74f9bd0eb5c9c650acf5f3823a77c8f4.exe
Filesize
82KB

MD5
e13d8b799b812cd0b0bacbd28e5841ac

SHA1
fc304a05e7bd761766af628306eff86cd26f0426

SHA256
7fd79ce768650515f1f3122d9954c2239027abfcf3a60a80aafd1d8f8a1d2999

SHA512
b810d80f987def08cdfd583e2a7f269694a5ce4640e58f2e7be53307f2d06649d47b2ddab897cb1643c89db79126f2e94513be3142a2c91bdf8d9494c0565880

Download Submit
memory/1552-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1552-1-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/1552-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1552-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3816-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3816-14-0x0000000001430000-0x000000000145F000-memory.dmp

Filesize
188KB

Download
memory/3816-25-0x00000000014F0000-0x000000000150B000-memory.dmp

Filesize
108KB

Download
memory/3816-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download