kinsing | 14e5a0c486aef3d0bd2b0938ac6cfe3b70d53cb7083ff324b1cd782678acf1b2 | Triage

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:40

Sharing

Report Analysis Logs

General

Target

74fdc65ad10422685fcc9ec10a8e2b90.exe
Size

122KB
MD5

74fdc65ad10422685fcc9ec10a8e2b90
SHA1

cecb98056a8c2c49bac73564d243a830f92c3402
SHA256

14e5a0c486aef3d0bd2b0938ac6cfe3b70d53cb7083ff324b1cd782678acf1b2
SHA512

c820e1930e8f3fa51fd65c15d58a286cb6ea1c694d310e97ea16aa0c0aaf600214bb08013c23671f7485f25d933dcde0d498296fe4ba0a1db398ddf22b7b453e
SSDEEP

3072:iNAflob/3Z7zGmVhorkU/G4Hm9VtlmSbReH:i6lc/3Z7KmkrgOmTtlm

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3440 956 WerFault.exe 74fdc65ad10422685fcc9ec10a8e2b90.exe

C:\Users\Admin\AppData\Local\Temp\74fdc65ad10422685fcc9ec10a8e2b90.exe
"C:\Users\Admin\AppData\Local\Temp\74fdc65ad10422685fcc9ec10a8e2b90.exe"
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 288
2⤵
- Program crash
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 956 -ip 956
1⤵
PID:3272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/956-1-0x00000000009D0000-0x00000000009FA000-memory.dmp

Filesize
168KB

Download
memory/956-2-0x00000000009D0000-0x00000000009FA000-memory.dmp

Filesize
168KB

Download