kinsing | fa1acd9b904a7aee91dd2998a50d44ba61870eeec22b73539676e30ffebd726e

General

Target
74edb16282dcea6af87090c9fb4266c0.exe
Size 42KB
Sample240125-th7ejabbem
SHA256 fa1acd9b904a7aee91dd2998a50d44ba61870eeec22b73539676e30ffebd726e
MD5 74edb16282dcea6af87090c9fb4266c0
SHA1 0d9129af6859e46c7ea1bb9196fe1bb7fb873dae
SHA512 b82bb470b5d9492d631604d11be3bae1493b8919f593169346ba85cae1531fd732456ab3ab5c5c879ff87a35526610fbe7c25492e8380667ec6b34618adf094a
SSDEEP 768:OMF+IJHpDbFYweKUXsMmUUacmRitYuVWjKvZZu2nI8JLtW:OMF+aHpDbeDXiRWqFxZi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing adware loader persistence stealer upx

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB96953-7D02-4594-AC15-F55FC9AACFCB}\Locale = "EN"	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB96953-7D02-4594-AC15-F55FC9AACFCB}\StubPath = "rundll32 msfacat32.dll,InitModule"	74edb16282dcea6af87090c9fb4266c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB96953-7D02-4594-AC15-F55FC9AACFCB}\IsInstalled = "1"	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB96953-7D02-4594-AC15-F55FC9AACFCB}\Version = "1,0,0,2"	74edb16282dcea6af87090c9fb4266c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB96953-7D02-4594-AC15-F55FC9AACFCB}	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EB96953-7D02-4594-AC15-F55FC9AACFCB}\ = "Systray component"	74edb16282dcea6af87090c9fb4266c0.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000022480-6.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	74edb16282dcea6af87090c9fb4266c0.exe

Loads dropped DLL 1 IoCs

pid	Process
4404	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000022480-6.dat	upx
behavioral2/memory/4404-8-0x0000000010000000-0x0000000010018000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}	74edb16282dcea6af87090c9fb4266c0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	74edb16282dcea6af87090c9fb4266c0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msfacat32.dll	74edb16282dcea6af87090c9fb4266c0.exe
File created	C:\Windows\SysWOW64\sft.res	74edb16282dcea6af87090c9fb4266c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	74edb16282dcea6af87090c9fb4266c0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	74edb16282dcea6af87090c9fb4266c0.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\InprocServer32	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\InprocServer32\ = "msfacat32.dll"	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\InprocServer32\ThreadingModel = "Apartment"	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\TypeLib\ = "{F46C1668-B5AF-46c5-AB7C-A678E8FCECFC}"	74edb16282dcea6af87090c9fb4266c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\ = "Microsoft copyright"	74edb16282dcea6af87090c9fb4266c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\ProgID	74edb16282dcea6af87090c9fb4266c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\ProgID\ = "MS"	74edb16282dcea6af87090c9fb4266c0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D88F653-4230-4af1-A6A3-54B8D3CD7DF4}\TypeLib	74edb16282dcea6af87090c9fb4266c0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4404	3948	74edb16282dcea6af87090c9fb4266c0.exe	87
PID 3948 wrote to memory of 4404	3948	74edb16282dcea6af87090c9fb4266c0.exe	87
PID 3948 wrote to memory of 4404	3948	74edb16282dcea6af87090c9fb4266c0.exe	87
PID 3948 wrote to memory of 4076	3948	74edb16282dcea6af87090c9fb4266c0.exe	88
PID 3948 wrote to memory of 4076	3948	74edb16282dcea6af87090c9fb4266c0.exe	88
PID 3948 wrote to memory of 4076	3948	74edb16282dcea6af87090c9fb4266c0.exe	88

C:\Users\Admin\AppData\Local\Temp\74edb16282dcea6af87090c9fb4266c0.exe
"C:\Users\Admin\AppData\Local\Temp\74edb16282dcea6af87090c9fb4266c0.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s msfacat32.dll
  2⤵
  - Loads dropped DLL
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\74EDB1~1.EXE >> NUL
  2⤵
  PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msfacat32.dll

Path C:\Windows\SysWOW64\msfacat32.dll
Size 32KB
SHA256 cc27353293cfe1ab780cd94e62b394107a58a9311dc4d59764b59b9a1be7802c
MD5 df51aee89027399f01e13d81506c5c9f
SHA1 08cd1a109a7ed7dcf7025fb9925ca69a301b8637
SHA512 c04d300852b741aa6d5f766099fa350979f5f0c3d93fafd65b12b2e9ceb355e12089f037cd75b484df648ebba1c08d03003df2b5b5d3fd32a8ea8ea74b39f58d
SSDEEP 768:dQO4N66rB65oPLo/FRGifb8rnf1FRSAs+DCp:Sz66F7KWnEjIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3948-0-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3948-1-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/3948-2-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3948-5-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4404-8-0x0000000010000000-0x0000000010018000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads