Overview

overview

10

Static

static

3

Battly-Lau...er.exe

windows7-x64

7

Battly-Lau...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 16:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Battly-Launcher-win-installer.exe

  • Size

    87.5MB

  • MD5

    8b85b5fb77be908dd9c778716d04ff7d

  • SHA1

    7084bd7914ebf6b18123cbee618c0c075b906877

  • SHA256

    0c5e3216f7f6bb80663143f75e816acc2bcc760cb47d3f7569ebcc9bdbdc2281

  • SHA512

    3b32e106c8aad91f4a5c828e917fff0598ea27e7c88f232a9b87faf771770ba61ff652abd396c9585566093ebb7c69c3019c27b3793021fc74ea0594a4ae6680

  • SSDEEP

    1572864:Qdc4v6Skl5L+Pe16OIb08t7oQwrCzDrelX+hefmUYL+RcN6kaWEgPM:gc48l5yW16OIbhahrCbelOh+YLB6kg7

Score
10/10
kinsingloader

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\is-10RM1.tmp\Battly-Launcher-win-installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-10RM1.tmp\Battly-Launcher-win-installer.tmp" /SL5="$7011A,90701607,832512,C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-win-installer.exe"
      2⤵
      • Executes dropped EXE
      PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-10RM1.tmp\Battly-Launcher-win-installer.tmp
    Filesize

    3.1MB

    MD5

    d7967ad8ffbc60b7255b62dbf6a733cc

    SHA1

    0a293aa4a177a93879eb40aba7930c1d7be0c0ff

    SHA256

    145f163d01ffbff37ea6cd7acc5f3384cd3e385a41ed707c3c2c67600b0e2da9

    SHA512

    e7efecd12b28881bd510897b026b00df759bb9e97896d6904504eeefd18750f96571f62b1e8dc2d19de43dd1d7a333c685d9396b3e5889199a73094e93ec5d69

    Download Submit
  • memory/532-6-0x0000000000A40000-0x0000000000A41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/532-8-0x0000000000400000-0x000000000071C000-memory.dmp
    Filesize

    3.1MB

    Download
  • memory/852-0-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

    Download
  • memory/852-7-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

    Download