kinsing | 66c34ef6cd48d4b403149e09a1097c2d8a9f8934d92ed20e9507999ed46b3b62 | Triage

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:35

Sharing

Report Analysis Logs

General

Target

74fb6cd02b6f2bd51170ba6fa97c6150.dll
Size

63KB
MD5

74fb6cd02b6f2bd51170ba6fa97c6150
SHA1

a52ed16a2cc62610799ae8e191fe15ceca89f680
SHA256

66c34ef6cd48d4b403149e09a1097c2d8a9f8934d92ed20e9507999ed46b3b62
SHA512

a1640e40f59b748c91fbcd7d8f9e8aa85a4e80da77ece47e4ab95f15649e84d5e837a707d29495afc0794cbe0e1163613cd13717d96043833dff68330aa41bdd
SSDEEP

1536:Bm1NGJVGLnVWumfvi+Kni1h62B75mSFN53ypbw:kX0VYafvixn+zmSF+pU

Score

10^/10

kinsing loader upx

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1848-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3964 wrote to memory of 1848	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 1848	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 1848	3964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fb6cd02b6f2bd51170ba6fa97c6150.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fb6cd02b6f2bd51170ba6fa97c6150.dll,#1
2⤵
PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download