kinsing | 171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe
Size

2.8MB
MD5

757eda9fd0f912c95437dfc531d6bdd9
SHA1

64c03db66d80a6a5c2568c2dd1709731e30a656f
SHA256

171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975
SHA512

ef8e1b298cf0bf24f7ad147b4398ccdd41247351b465d12ad2ebb352de18bc761e1bbf5a4793a1c1b3d9a93ee9e303b6d763fb046e0dd325a64ace9e85dbe14b
SSDEEP

49152:OlN+FV7+s5TrEIwOfp21cHRrZ+te5D8K69/ZUSCfmzz9YVgY:RXxwYxrZbpSC+zzKi

Score

10^/10

kinsing discovery loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 1 IoCs

Processes:

171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe

description ioc process

File opened for modification C:\Windows\System32\alg.exe 171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe

description pid process

Token: SeTakeOwnershipPrivilege 1988 171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe

description	ioc	process
File opened for modification	C:\Windows\System32\alg.exe	171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1988	171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe

C:\Users\Admin\AppData\Local\Temp\171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe
"C:\Users\Admin\AppData\Local\Temp\171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-1-0x0000000140000000-0x00000001402E1000-memory.dmp

Filesize
2.9MB

Download
memory/1988-0-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1988-8-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1988-7-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1988-11-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1988-13-0x0000000140000000-0x00000001402E1000-memory.dmp

Filesize
2.9MB

Download