kinsing | 0e07fe6eddfa25fbda9ab54224ebc739b5bb62fbcd2443605b15a0b870effcdd

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f0fa32fb8ab87065e21bdfa5a710b7.exe
Size

889KB
MD5

74f0fa32fb8ab87065e21bdfa5a710b7
SHA1

b1c73b3ce7efcc73c86023d39bc123b1ca7bf894
SHA256

0e07fe6eddfa25fbda9ab54224ebc739b5bb62fbcd2443605b15a0b870effcdd
SHA512

dbc0848107feda60d1d43fe7015788fe765e13f9a9de461c26ee7b764e9bd291b8b69901415f2e5c67de985fac2004128018d8828e2b1a327eca596346556bde
SSDEEP

24576:rxR9AV0O+7sgzp+8fdYqZmpMebLdiGxJ8uYAvtrKOuz62:205ytWUteOuz62

Score

10^/10

kinsing evasion loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

74f0fa32fb8ab87065e21bdfa5a710b7.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Wine 74f0fa32fb8ab87065e21bdfa5a710b7.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5068 1156 WerFault.exe 74f0fa32fb8ab87065e21bdfa5a710b7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Wine	74f0fa32fb8ab87065e21bdfa5a710b7.exe

pid	pid_target	process	target process
5068	1156	WerFault.exe	74f0fa32fb8ab87065e21bdfa5a710b7.exe

C:\Users\Admin\AppData\Local\Temp\74f0fa32fb8ab87065e21bdfa5a710b7.exe
"C:\Users\Admin\AppData\Local\Temp\74f0fa32fb8ab87065e21bdfa5a710b7.exe"
1⤵
- Identifies Wine through registry keys
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 280
2⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1156 -ip 1156
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1156-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download