kinsing | a543eb4c1241b1d17933d5ca5964eebee04c89ac4220b2957e3287c235ba9917

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:05

Target

74ee20989720d8c3c1297404cb9b8ae9.exe
Size

57KB
MD5

74ee20989720d8c3c1297404cb9b8ae9
SHA1

07abe91df0caf355d642f6988469b59d3a4f44d5
SHA256

a543eb4c1241b1d17933d5ca5964eebee04c89ac4220b2957e3287c235ba9917
SHA512

4e103f1bce857675f768d876fb7075417cbeb9f353737a4c6b34b09d279561b8494987a2897e5a05c840b9fce8bb54a4621d1812dd9bff1dc6237a72b52c1bac
SSDEEP

1536:WqBwbLWJLJFKqAZzrZA4kJJodxlAfEXh9lQCivFxbge:WqBFJLzgOJJohw0nqNt5

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Loads dropped DLL 2 IoCs

Processes:

74ee20989720d8c3c1297404cb9b8ae9.exe

pid process

3192 74ee20989720d8c3c1297404cb9b8ae9.exe
3192 74ee20989720d8c3c1297404cb9b8ae9.exe
Drops file in Program Files directory 2 IoCs

Processes:

cmd.exe

description ioc process

File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe
File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3192	74ee20989720d8c3c1297404cb9b8ae9.exe
3192	74ee20989720d8c3c1297404cb9b8ae9.exe

description	ioc	process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74ee20989720d8c3c1297404cb9b8ae9.exe

description	pid	process	target process
PID 3192 wrote to memory of 4928	3192	74ee20989720d8c3c1297404cb9b8ae9.exe	cmd.exe
PID 3192 wrote to memory of 4928	3192	74ee20989720d8c3c1297404cb9b8ae9.exe	cmd.exe
PID 3192 wrote to memory of 4928	3192	74ee20989720d8c3c1297404cb9b8ae9.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\ife.txt "C:\PROGRA~1\INTERN~1\ieframe.dll" /a
2⤵
- Drops file in Program Files directory
PID:4928

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ife.txt
Filesize
19.5MB

MD5
4d0bbc3de1244b9da019b7d93a105ac5

SHA1
869dce84b4c42969162a4ff39d3c94d2693884b6

SHA256
f0168c2f57161102bfa744c34614abdc924ef25609ad3a8a32c80bc95dda98bf

SHA512
c826c4bd087d87e865b6ca938d6dedc6456e658e501fb23d1166c3ced149c953939edae2c25e70277fe1cfd9eceb0581c524e443882dc451a607a0a9355044e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6B9C.tmp\nsExec.dll
Filesize
6KB

MD5
e54eb27fb5048964e8d1ec7a1f72334b

SHA1
2b76d7aedafd724de96532b00fbc6c7c370e4609

SHA256
ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

SHA512
c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6B9C.tmp\time.dll
Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit