kinsing | 56e62518fdf791d5c5f673dcc004b0569c5dd4108e2873adf16cae76fec91e5d

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:37

Target

$PLUGINSDIR/Hookkernel.dll
Size

275KB
MD5

65c2129a5c0cabd657022cf49a1a96a3
SHA1

03c529e0226eb5b41cd91708512dbd58edecd600
SHA256

0aa0271fc27552af57fd171c3288b00b600c912a60d8752bf70f90b997f5d67c
SHA512

b9900c3f6c93cf30c55cf718d96743728535bcb820ffaf4efa3c1ab874c684903a8fb30c2e88babdd468c2badc49306186df95f32d86bfb1a84d8d182bc8143c
SSDEEP

3072:VOGElO2Vtd2LW5ukXA8l7xLsx1BuAYzPWMYCWyRQzaniwlXs5Yo4qD1icgE:FEzrd2LWDXA8lVsNczPWtCW/zO3XtooE

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exe

pid process

5644 rundll32.exe
5644 rundll32.exe
5644 rundll32.exe
5644 rundll32.exe
5644 rundll32.exe
5644 rundll32.exe
5644 rundll32.exe
5644 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

5644 rundll32.exe

pid	process
5644	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2132 wrote to memory of 5644	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 5644	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 5644	2132	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Hookkernel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132

memory/5644-0-0x00000000030E0000-0x0000000003125000-memory.dmp

Filesize
276KB

Download