kinsing | c306ae721c046eb3246e863b7bd4f1fdecb4dac5c1ed04c06f29c582443a389c

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:33

Target

uninst.exe
Size

84KB
MD5

f71a855850fe6af8c99a146f5283ea5a
SHA1

8cd8cf69659ed2324fd03bf88b047beeb9c19bc5
SHA256

aa058750c9f285b8fa54ee096dedabec200538eb4a185a4519a5f6a928748cc0
SHA512

9d10ee5f9b7c2aa5dfbe4d028ecf964874370107c8549183e5b8225e3d3080c5d11a27a21922d3228ceb38cb6a44fb3fab22db4b6f98954855c90c8b269cbdc3
SSDEEP

1536:jbSqZVJdThUxmskJmtTPCrP6mpeuNyQ88AI8bCV2gAncq:jbLpZuEskJ0TPCrS/INIcq

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2116 Au_.exe
Loads dropped DLL 1 IoCs

Processes:

Au_.exe

pid process

2116 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2116	Au_.exe

pid	process
2116	Au_.exe

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

uninst.exe

description	pid	process	target process
PID 64 wrote to memory of 2116	64	uninst.exe	Au_.exe
PID 64 wrote to memory of 2116	64	uninst.exe	Au_.exe
PID 64 wrote to memory of 2116	64	uninst.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:64

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nslC8FF.tmp\LangDLL.dll
Filesize
5KB

MD5
9b11a5ff844d591aebaf526b5f1d5582

SHA1
e60948a5101c282957ffee3988816a9187963565

SHA256
9d23b28fa88d485810d8895d429365a7c826a0e9804ca8697446a05bbfdc196c

SHA512
8dc48f5b94da146798e1eca08ed33105422cb841badbaf3d868cebf167307162fae001386510977211829f96395f4142d2dc8311a2837d0d0a28ad5f6ff53319

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Filesize
84KB

MD5
f71a855850fe6af8c99a146f5283ea5a

SHA1
8cd8cf69659ed2324fd03bf88b047beeb9c19bc5

SHA256
aa058750c9f285b8fa54ee096dedabec200538eb4a185a4519a5f6a928748cc0

SHA512
9d10ee5f9b7c2aa5dfbe4d028ecf964874370107c8549183e5b8225e3d3080c5d11a27a21922d3228ceb38cb6a44fb3fab22db4b6f98954855c90c8b269cbdc3

Download Submit