kinsing | hxxps://zaf895[.]com/File[.]zip?c=AO6CsmWAMAUAfmMCAENaFwAGAAAAAACl

Resubmissions

25-01-2024 15:52

240125-ta3flsbabk 10

25-01-2024 15:51

240125-taqf2sbaap 10

Analysis

max time kernel
600s
max time network
559s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
25-01-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zaf895.com/File.zip?c=AO6CsmWAMAUAfmMCAENaFwAGAAAAAACl

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3500	msedge.exe
3500	msedge.exe
5016	msedge.exe
5016	msedge.exe
3040	msedge.exe
3040	msedge.exe
1304	identity_helper.exe
1304	identity_helper.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5016 msedge.exe
5016 msedge.exe
5016 msedge.exe
5016 msedge.exe
5016 msedge.exe
5016 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5016 wrote to memory of 3376	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 3376	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4680	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 3500	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 3500	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 4604	5016	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zaf895.com/File.zip?c=AO6CsmWAMAUAfmMCAENaFwAGAAAAAACl
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb18f53cb8,0x7ffb18f53cc8,0x7ffb18f53cd8
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1808 /prefetch:2
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,578154734559015264,9839510741220177015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5816 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
bb88128b6b2d63f04c36ce68ed52d0a1

SHA1
29cd0515976a9249fc96a9d77c9986238cd1c2da

SHA256
19341f9fde32349d43cf9951f118ebbff856499e0e6875101eaf2db37a7d7d8b

SHA512
ab3071e116a32fc105a868fe9f3cd11cb282fc6cdc1e101b09c7f6269502f98b34b2f0a2ec32eb2b537073e2b20bd22cefd2fdcd4be87f8b169e6eed3bed1ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
467B

MD5
a968c0728289e70e9a0750a0d8acea1c

SHA1
a01409f1fdcd111b8ff0eadbad32283c51852942

SHA256
87742357b94ec20a46086c8ead7d84e73c8b09448bc09ea2ba61d7dfc25dc0fa

SHA512
bb08e397af881c5297d0c9c00b083e5d2d9f6a2fd456f308a481229238a32d54fec895751ff87754b42c2d92e03b2a11b16cebf8f7cf432cee0d318cfc14157b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
178B

MD5
4b903bfca92fa3b11d21a79bbdf72b8f

SHA1
ea0afc5ad96d52ab6b6c5ee3bbdf6fa5d50695ab

SHA256
f18f7c98fd2a4b9e6b7e334330e8e9e417df2c765dfceb29ec417af027a0f1b2

SHA512
6c4b0812cc6ceb9fea8bb9da29f3e08c499eae2692b31214bf66ede6c8c415eed0f1dd2177ab9e430c05cd5b73ac5e8a50253e6664353ba85efd5bcdfabcb0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
33e5de6291187b4ca799ebe3be7c12ed

SHA1
d9628dff2af5f0bc2a1e9d1cc9964313e9a2acf8

SHA256
d67c32b1b6cdfab90a6cda8d3f133a8511858917def01a8a8aa3cf117edee821

SHA512
607f0bed80c8b4ea3712c02830f3fb40b5e0a0ad77b9bc20926b9651759faddebb773fa9f4cfa86e0425f3eebc91cde86d004a8af44e4e5a0f24e332c3e2fa2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d0ea179ae0d0e0b7b2d14f31c66e31db

SHA1
88946be0e8b16020ffa476d54bd229635dcd7429

SHA256
5d5bda6c221063368dea5020fb5799005b625e553caba4090ec70e21a5e77ca7

SHA512
69c7a7bcc41ed3adc8941c780c4397f18291153980903de1d2f71959f626b8db8c463fb2bfe02886595adbea3344d79fdbbc6547eef61d098deb57299eaa6970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
25KB

MD5
87796f83a580ad1059639b7b6f48c978

SHA1
3aeb3452c1d42aa82dcc46fac0eff546266958ca

SHA256
ca9281ab005e47fe20e132b81ccfbf7a5f0e6d845cd3412129bcb07cacb1397d

SHA512
196d07ff37bf35b583ba80ef92e0277eee328925a77accb3dae1ca10a356a7924f49a7e6233db1b8b320eef6beeb9677ee7d642dd4bcdb2f1343cfe84fb186cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
acb42a5e91f518aeb7129394766ea224

SHA1
e5ae834691c0f773812a89b6ebe92b6e2273fb00

SHA256
d6072fba457f93ccbf1961e902d8283d496da5eb9ed9db9c609bfd7541c391d1

SHA512
489ceb797e09ba38acb40277ef9519e4f6e56cd4fe8c65d0424ee4bfa8c156f23bfc004ad9b53f51c191ab761ac1481b8e4136adf81c8df0e139ef198cc4cd03

Download Submit
\??\pipe\LOCAL\crashpad_5016_OSVJQUMLCEKTZMIP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit