kinsing | 388ad819640a7cadc0a0fa669d30deea191a4918ad6e677b41f04b54c7b4a28e

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:12

Target

74f0e077f6d09858a83842228e59d85b.exe
Size

14KB
MD5

74f0e077f6d09858a83842228e59d85b
SHA1

d98e00ac316432b91349973ce3fefc2bf8e9b9a7
SHA256

388ad819640a7cadc0a0fa669d30deea191a4918ad6e677b41f04b54c7b4a28e
SHA512

760b8e018fb38ad2c42e36f0628cc7b02c1dd4e469dea47bfe3199acaedc685c36b42b511d4f99f07c579b5c115ff92609b3c7a48353f26ef1ab297cf85801c5
SSDEEP

384:tfoA1MPda3BPCKGTd4yhGdAd0g8Sp9u7zJrAfzV:twaMVa3BPO4wsrAJ

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Executes dropped EXE 1 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

pid process

4472 74f0e077f6d09858a83842228e59d85b.exe

pid	process
4472	74f0e077f6d09858a83842228e59d85b.exe

Drops file in System32 directory 2 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe	74f0e077f6d09858a83842228e59d85b.exe
File opened for modification	C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe	74f0e077f6d09858a83842228e59d85b.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

description pid process

Token: SeIncBasePriorityPrivilege 4116 74f0e077f6d09858a83842228e59d85b.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	4116	74f0e077f6d09858a83842228e59d85b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

description	pid	process	target process
PID 4116 wrote to memory of 1572	4116	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe
PID 4116 wrote to memory of 1572	4116	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe
PID 4116 wrote to memory of 1572	4116	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\74F0E0~1.EXE > nul
2⤵
PID:1572

C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe
C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe
Filesize
14KB

MD5
74f0e077f6d09858a83842228e59d85b

SHA1
d98e00ac316432b91349973ce3fefc2bf8e9b9a7

SHA256
388ad819640a7cadc0a0fa669d30deea191a4918ad6e677b41f04b54c7b4a28e

SHA512
760b8e018fb38ad2c42e36f0628cc7b02c1dd4e469dea47bfe3199acaedc685c36b42b511d4f99f07c579b5c115ff92609b3c7a48353f26ef1ab297cf85801c5

Download Submit
memory/4116-0-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download
memory/4116-1-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download
memory/4116-6-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download
memory/4472-7-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download