kinsing | 92ac5bb64c36cbe636def0750621d2bca763a4c8a2277f7ff6790d65606bc0b5 | Triage

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:38

Sharing

Report Analysis Logs

General

Target

74fc85c9233a87cfe65576da86b1cae7.dll
Size

24KB
MD5

74fc85c9233a87cfe65576da86b1cae7
SHA1

4f99291abe05aba0ed0cbc4844bb1976034dd742
SHA256

92ac5bb64c36cbe636def0750621d2bca763a4c8a2277f7ff6790d65606bc0b5
SHA512

df3447481a4846ff757ad1be5f5adcf73699e6a8d85fac8217f8bab304ff0671343d771434e83b52a852efbdefeedd2c5d2b9f391da45e85940d1c2f238666ac
SSDEEP

768:+RBmjBN847AYRu15zkrSvSp6PL/m1vxYU+:0gjT7AYRu1OrSvSp6PLODY

Score

10^/10

kinsing loader upx

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3976-0-0x0000000000700000-0x0000000000713000-memory.dmp	upx
behavioral2/memory/3976-1-0x0000000000700000-0x0000000000713000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\mseditcpl.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2552 3976 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4552 wrote to memory of 3976	4552	rundll32.exe	rundll32.exe
PID 4552 wrote to memory of 3976	4552	rundll32.exe	rundll32.exe
PID 4552 wrote to memory of 3976	4552	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fc85c9233a87cfe65576da86b1cae7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fc85c9233a87cfe65576da86b1cae7.dll,#1
2⤵
- Drops file in System32 directory
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 600
3⤵
- Program crash
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3976 -ip 3976
1⤵
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-0-0x0000000000700000-0x0000000000713000-memory.dmp

Filesize
76KB

Download
memory/3976-1-0x0000000000700000-0x0000000000713000-memory.dmp

Filesize
76KB

Download