kinsing | eb2b142e75be8ff796246a96fa301ecab7066e5af2ec540671b1a641ba8af62d

General

Target

74eb1dd660b60bc76e3000cecc00bbee.exe
Size

39KB
MD5

74eb1dd660b60bc76e3000cecc00bbee
SHA1

f024e798a854b485abd2c73d38b7d0eb95691ac7
SHA256

eb2b142e75be8ff796246a96fa301ecab7066e5af2ec540671b1a641ba8af62d
SHA512

5cd10df0464800141f0cf8983c4aaaec3d204021b6a2e240a7a49372fa6b732a19872e28734bf31bb38a193afd7bde5400b0e746e2f5dab06090ef704e7da1b8
SSDEEP

768:9uL6m2A/pz1dD/24xLHAV4q2YreCFE21+zpj:Tm2A/pz144BHAV4dYr7FNo

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Drops file in Drivers directory 64 IoCs

Processes:

74eb1dd660b60bc76e3000cecc00bbee.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\vwifibus.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\storufs.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\SpatialGraphFilter.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\usbcir.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\mlx4_bus.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\mshidkmdf.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\MSPQM.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\WUDFRd.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\flpydisk.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\ndisuio.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\pcmcia.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\vms3cap.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\udecx.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\kbldfltr.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\pmem.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\usbuhci.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\hidbth.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\AgileVpn.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\rdpvideominiport.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\UcmUcsiAcpiClient.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\HidBatt.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\ipnat.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\nvstor.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\vmbus.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\ADP80XX.SYS	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\megasas35i.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\usbohci.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\winnat.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\amdsbs.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\errdev.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\intelppm.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\Drivers\UcmCx.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\vstxraid.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\xboxgip.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\circlass.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\dmvsc.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_I2C_CNL.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\mausbip.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\ndiswan.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\terminpt.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\usbccgp.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\bthmodem.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\nvraid.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\SerCx.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\fdc.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\evbda.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\hyperkbd.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\mausbhost.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\DRIVERS\ndistapi.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\system32\drivers\SpbCx.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\amdi2c.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSSi_I2C.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\ibbus.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\BTHUSB.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\MSTEE.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\umpass.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\buttonconverter.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\SiSRaid2.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\bxvbda.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\drivers\usbprint.sys	74eb1dd660b60bc76e3000cecc00bbee.exe

Drops file in System32 directory 6 IoCs

Processes:

74eb1dd660b60bc76e3000cecc00bbee.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys	74eb1dd660b60bc76e3000cecc00bbee.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys	74eb1dd660b60bc76e3000cecc00bbee.exe

C:\Users\Admin\AppData\Local\Temp\74eb1dd660b60bc76e3000cecc00bbee.exe
"C:\Users\Admin\AppData\Local\Temp\74eb1dd660b60bc76e3000cecc00bbee.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3816-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3816-2-0x0000000077652000-0x0000000077653000-memory.dmp

Filesize
4KB

Download
memory/3816-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3816-3-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/3816-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3816-8-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing