kinsing | e19e42e2060c7fd2443bc2c606b1f99bcc729b815c964f09aad81ac7a4de8ce7

General

Target
GOLAYA-DEVOCHKA.exe
Size 239KB
Sample240125-tk28laach7
SHA256 d74b26bea7fd5d0206c63b5251569a57c889debb2cac8e5ad8908a658b8fcd2a
MD5 cc3e79604fed1f63c7f5f24916fd1d51
SHA1 08872ad23e2e9e897d30506d783ed15f4491a25b
SHA512 22c20dc56f46e44e522eac57ded0da8b571e6da2fd37f083509846bb557e513081daddd4d7d9d6cce86d7216ffdfb4ac6e4311e2259dca956d1af5253630e547
SSDEEP 3072:QBAp5XhKpN4eOyVTGfhEClj8jTk+0hijkEDboYxU044U/13+Cgw5CKHy:HbXE9OiTGfhEClq9YEXoyDjUEJJUy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing discovery loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	3560	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.ini	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-DEVOCHKA.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	GOLAYA-DEVOCHKA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2872	1384	GOLAYA-DEVOCHKA.exe	88
PID 1384 wrote to memory of 2872	1384	GOLAYA-DEVOCHKA.exe	88
PID 1384 wrote to memory of 2872	1384	GOLAYA-DEVOCHKA.exe	88
PID 1384 wrote to memory of 3560	1384	GOLAYA-DEVOCHKA.exe	90
PID 1384 wrote to memory of 3560	1384	GOLAYA-DEVOCHKA.exe	90
PID 1384 wrote to memory of 3560	1384	GOLAYA-DEVOCHKA.exe	90

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2872
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

slooooowthespeedafer.vbs

Path C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs
Size 1KB
SHA256 1ccbc7d478e6ec655aa960addeec99037913565f905bf0edf02694cb27a2229c
MD5 64ad61d0535f2f16d2e0898f5becc6d7
SHA1 d019ae5edf589cec0812c3d703f75dfeefd0a2ce
SHA512 e31ed889d87bf036fa80341f2fdb3086ea5b150693343fa422db225c2d136e11a761cf801bf384c2d10c7635c8fb03be88025cd9af455c222298ab44bf3afb46
MD5 SHA1 SHA512

Submit Download

svezee_techenie_cheloveko.bat

Path C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat
Size 1KB
SHA256 97c36a9e98886b271bd479fde0f384b75ef04399ebd1554d2490966d56d385d9
MD5 6daad30db16dca2393e95dc79993b935
SHA1 539786a8fc9d50a02c4d0299a88ce7c09ed414c1
SHA512 ed9d7b8b3d14fc2136dd28788874446559f388e591c20d7e2e343a5a1d96bc1af46e6586da0a78ad0bcd15c9a170aad9d37c4b0dd840298b117b51ab7dac22a8
MD5 SHA1 SHA512

Submit Download

xranilise_vsei_figni_tut.bok

Path C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok
Size 99B
SHA256 c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370
MD5 86dc7199339e9623d9cb19240a752740
SHA1 71cb2333efd767a21c031c23bb5b7e81115aff18
SHA512 eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 9e8f7c183744c28ee7e84f2804a12185b1d330e25a929dd71c1adee6f6dbfb93
MD5 b4434980101442bcce3e0b0f6d12d743
SHA1 1a68111eba898c9b337b1dcd8cd803e339df5335
SHA512 86fc9e287d669446159989e463774cba0a5105c5394231782f41fd61cb41647ab48b4d773de11e06538721c4b10900548ac328e38fbfac217927dd9f9fdf9941
MD5 SHA1 SHA512

Submit Download

memory/1384-39-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/1384-41-0x0000000000400000-0x0000000000432000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads