kinsing | a762555ec28dde00a9cd2c763589709e240555e2bd4aabb9f4e14d67a9919bc0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe
Size

42KB
MD5

fdb5699a52f5c2de8c9c0d445ec47a56
SHA1

39692bfef655fdc3a46b53788316207d73e81fb4
SHA256

a762555ec28dde00a9cd2c763589709e240555e2bd4aabb9f4e14d67a9919bc0
SHA512

1b3e45181d811b068d4d8dac27638ddeab0308b27f7e83be5954f62e8663a458ecacebd9e7ea9dfd1ab26e6b1ce24c275bc61c60ae50e0f8bc0d09ad8b311588
SSDEEP

768:bxNQIE0eBhkL2Fo1CCwgfjOg1tsJ6zeen754XcwxbFqL:bxNrC7kYo1Fxf3s05rwxbFG

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pissa.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

pissa.exe

pid process

3060 pissa.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3060	pissa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe

description	pid	process	target process
PID 3276 wrote to memory of 3060	3276	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe
PID 3276 wrote to memory of 3060	3276	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe
PID 3276 wrote to memory of 3060	3276	2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe	pissa.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_fdb5699a52f5c2de8c9c0d445ec47a56_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3276

C:\Users\Admin\AppData\Local\Temp\pissa.exe
"C:\Users\Admin\AppData\Local\Temp\pissa.exe"
2⤵
- Executes dropped EXE
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pissa.exe
Filesize
42KB

MD5
a86915e479cbe0eacaef2661864f44e8

SHA1
f0695cc083484e606e7b268e520c56878a14e295

SHA256
11cd0aa44b4f72a6b24936ad901af009584f2ff508b8332378203c3668e45268

SHA512
f8fa0065504af42b3a0bd24c0de09d51eb67f0a5b992ee343501c59eddb350d5a3f3a588087d32491e80986fe4332dbba5c47e67e0af8f47812eea2c9a97b2c5

Download Submit
memory/3060-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/3060-18-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/3276-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/3276-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/3276-2-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download