kinsing | 6c59b4a35265a9c3cd81fc506205fbe681dbe34813bf7c8b5dcebc014e4423ed

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe
Size

43KB
MD5

df08ab17a14bd1fa5f17a12c7b39fee0
SHA1

fcc34cba5d7ee190354b3d012bdc523f8b024401
SHA256

6c59b4a35265a9c3cd81fc506205fbe681dbe34813bf7c8b5dcebc014e4423ed
SHA512

b9f131f3b31c4bc58a292c8ea56cbe79f0df3dbf784590a4792b7cb52861d637176bcb7cd7d4d7923e13b1ac8c4d6bf57d4dc3b1479ee530e159531ab4160500
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqmz4kmmI3:bc/y2lkF0+BjjII3

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\rewok.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

rewok.exe

pid process

5096 rewok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5096	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe

description	pid	process	target process
PID 2984 wrote to memory of 5096	2984	2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe	rewok.exe
PID 2984 wrote to memory of 5096	2984	2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe	rewok.exe
PID 2984 wrote to memory of 5096	2984	2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe	rewok.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_df08ab17a14bd1fa5f17a12c7b39fee0_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\rewok.exe
"C:\Users\Admin\AppData\Local\Temp\rewok.exe"
2⤵
- Executes dropped EXE
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe
Filesize
43KB

MD5
2fd8fbf46e6a71c97cd09ca1574598d0

SHA1
d29b9e6397b0e9ffb66c92a6e6f49e079fb42b4d

SHA256
5717c5cabd766a0c2f08ea07f16edfae2ef6a09d4f707836244cdbe54b1e7699

SHA512
eb3f12ed19d92556f55883f0ad4304cd7825a9d334f9ed13c2fc49794c603ecea41f6a1df1f2437c0cce1d95e9cf43803ca6ef710e7a80e23689f79442957fdc

Download Submit
memory/2984-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2984-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2984-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5096-20-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download