kinsing | 0463b4e565fdeeb1511beea6e9d152ec3939298c20fdef976a52c1d8b5ecdfb0 | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:44

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsLANG.dll
Size

80KB
MD5

fa1763b462940d9646732678a1f91b6b
SHA1

2d3651b31e97204302721d62c4432d06b82e8e85
SHA256

2e20675e85d0cf4c8b12b3997e7b1351329b954ce60ace01cd363571f7b8c3ea
SHA512

4b842cab31569c5e821ae729dd91b85f67e043e3628aee5fc71cd1b4caf51b062564570f1ecec2db3e9b4abd6c37583bff808bda479593f8f27464ead237f6ac
SSDEEP

1536:AsB1XsZc0dE+6MHqW+OciAaPqsWjcdqdg5y2fl:Dsh68qW+m3P1qdg5y2f

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

556 3940 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2224 wrote to memory of 3940	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3940	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3940	2224	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsLANG.dll,#1
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 600
2⤵
- Program crash
PID:556

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsLANG.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3940 -ip 3940
1⤵
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads