kinsing | c933673d311b1e5f31d223a117c227e282b14c9b990e101e4f1f19769b3b2f2c | Triage

Analysis

max time kernel
87s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:01

Sharing

Report Analysis Logs

General

Target

淘宝推广程序（免安装）.exe
Size

72KB
MD5

b9a03885af0b3a1196479fd44a0beb02
SHA1

1d8bdb816e3fe4f435f8d8ab7daeff81a2fcac9e
SHA256

9297a9f0e1d9d221e8e100801e49f6004789c8a9acf92cbf41b9808607f133e8
SHA512

dd55ebeb79e8cc3b5db0d205b6b51852687acc58ce1c91bc28a9d94e395170cb0b7bad55df0df76c58768814f3a71d5b4c77243d7e5de7d0936679e0440de9c1
SSDEEP

768:fxw2d0vYkwCB8/2uscLHo1Ot0CIkU0dsh8BrFIjZraCbfzUmWQw2d:e2d0ATgqHHIYdsWBrGjZLbfzW/2d

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

淘宝推广程序（免安装）.exe

pid process

4008 淘宝推广程序（免安装）.exe
4008 淘宝推广程序（免安装）.exe
4008 淘宝推广程序（免安装）.exe

C:\Users\Admin\AppData\Local\Temp\淘宝推广程序（免安装）.exe
"C:\Users\Admin\AppData\Local\Temp\淘宝推广程序（免安装）.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...