kinsing | 2e979470b3d1dce627499d443d3cc32e1f13c426836672f6cb8c776130d65879

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Size

1000KB
MD5

74ffc0a1c80aaf9c6ed0d41d11ccdf8a
SHA1

0ab7486015e53edc9dc1b7c08b7120cb32165dec
SHA256

2e979470b3d1dce627499d443d3cc32e1f13c426836672f6cb8c776130d65879
SHA512

b4a93ca848d34000337c96630a10f5ad294b2ef993ecebd25876e572a7bc568daca534b50d196e966d76840e6392a70205026f712e8f260f9f67482a8ad9eaa8
SSDEEP

24576:hFD6uKoaNNYxPA1Piah2b1Ao3QDGu1B+5vMiqt0gj2ed:fKoaNNYxYwah2d3KGcqOL

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid process

4068 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Executes dropped EXE 1 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid process

4068 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

9 pastebin.com
11 pastebin.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid process

4068 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4668 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid process

4068 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
4068 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid process

4200 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid process

4200 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
4068 74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid	process
4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid	process
4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

flow	ioc
9	pastebin.com
11	pastebin.com

pid	process
4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid	process
4668	schtasks.exe

pid	process
4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid	process
4200	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

pid	process
4200	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe

description	pid	process	target process
PID 4200 wrote to memory of 4068	4200	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
PID 4200 wrote to memory of 4068	4200	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
PID 4200 wrote to memory of 4068	4200	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
PID 4068 wrote to memory of 4668	4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe	schtasks.exe
PID 4068 wrote to memory of 4668	4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe	schtasks.exe
PID 4068 wrote to memory of 4668	4068	74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
"C:\Users\Admin\AppData\Local\Temp\74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4200

C:\Users\Admin\AppData\Local\Temp\74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
C:\Users\Admin\AppData\Local\Temp\74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe" /TN Google_Trk_Updater /F
3⤵
- Creates scheduled task(s)
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\74ffc0a1c80aaf9c6ed0d41d11ccdf8a.exe
Filesize
1000KB

MD5
3bf67225a8bbad6aa22f080ef64e0bcf

SHA1
3354e7f0bb2502302a0dfa36117b96e4a5f684bc

SHA256
b9ac3221838487c19731ae57d004ccee3cc39a0d9c0eafefb497c1aabf1c56a7

SHA512
a55bf62a642992f3a12d1443d626194e8d2b1c6bccb90e37f5f1aa445a1c865fe05af0f07e90296cd6ab142d6d4358c69c6d93c94d51967b92a3400671e4086f

Download Submit
memory/4068-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4068-14-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/4068-20-0x0000000004F50000-0x0000000004FCE000-memory.dmp

Filesize
504KB

Download
memory/4068-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4068-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4200-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4200-1-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/4200-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4200-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download