kinsing | c31caefe53f3fce951a7676beb1496992e7946346829591ef6e3da4a836d7962

Analysis

max time kernel
160s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:44

Target

setup.exe
Size

25.0MB
MD5

d9cb6b15ec112ef3f774595bf7dd470f
SHA1

59c9419e5c124a0faa61c330ed8b32365c8bcfca
SHA256

c31caefe53f3fce951a7676beb1496992e7946346829591ef6e3da4a836d7962
SHA512

3ea52db7b4fdc289281fc94e15c60edcf3feb35217f173658f7c0782405afd52389866032803576a83545289486dd123e96b641c2acd8d982ed4ff1d764e4d35
SSDEEP

393216:izurZSURipVeO4OI8H/1OmXyv2r+XjxTEXEYCRQdw4a5G7utZ4+sj:iRURQVm4sl26XjxTEP5u4aE7utZ4+a

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Executes dropped EXE 1 IoCs

Processes:

setup.tmp

pid process

1980 setup.tmp
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2996 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2996 taskkill.exe

pid	process
1980	setup.tmp

pid	process
2996	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2996	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

setup.exesetup.tmp

description	pid	process	target process
PID 1512 wrote to memory of 1980	1512	setup.exe	setup.tmp
PID 1512 wrote to memory of 1980	1512	setup.exe	setup.tmp
PID 1512 wrote to memory of 1980	1512	setup.exe	setup.tmp
PID 1980 wrote to memory of 2996	1980	setup.tmp	taskkill.exe
PID 1980 wrote to memory of 2996	1980	setup.tmp	taskkill.exe
PID 1980 wrote to memory of 2996	1980	setup.tmp	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\is-L732K.tmp\setup.tmp
Filesize
3.0MB

MD5
6bbe594c03d4f8383ad9d0476b4ed596

SHA1
e3f3c212969ab97ccdc9445458bbb66ab3e25cf4

SHA256
d7e85468b8ff287448debaef7add1ee676f0b9bb0b2c59a9edeed9a1bf9430d6

SHA512
cdc721c9e262a5d076fad2516badf690647000b487278fea829c981474e746f2bb7d59cc00e233b29de8a463f1b19e1ef59bbeeba6d2493edbbdb75fdfcfdb92

Download Submit
memory/1512-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1512-7-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1980-5-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/1980-8-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/1980-12-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download