kinsing | 050e4dfa4905b776eb18859d462cad4467da27b4cceaf0a778a8f0f7596a81fb

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f2109124f3f6fed6b33657e13db3d7.exe
Size

506KB
MD5

74f2109124f3f6fed6b33657e13db3d7
SHA1

8743e6c7389539f7a371487b966ce37819575269
SHA256

050e4dfa4905b776eb18859d462cad4467da27b4cceaf0a778a8f0f7596a81fb
SHA512

f75d03c668047e4509e86f39a7da915bc8eaff0656e0b1ada3b47ac1211bafc2023afc128b816f87a9db48150067b7e2a5e14dfea2bd0e91285412304cbcd149
SSDEEP

12288:F6+uDDCWVNiIjKEiefJyZGTA09KsozYyutzzS:FQvBVNSEi28ZGdgv9ux2

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe

pid process

116 74f2109124f3f6fed6b33657e13db3d7.exe
Executes dropped EXE 1 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe

pid process

116 74f2109124f3f6fed6b33657e13db3d7.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

12 pastebin.com
14 pastebin.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe

pid process

116 74f2109124f3f6fed6b33657e13db3d7.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2496 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe

pid process

116 74f2109124f3f6fed6b33657e13db3d7.exe
116 74f2109124f3f6fed6b33657e13db3d7.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe

pid process

4156 74f2109124f3f6fed6b33657e13db3d7.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe74f2109124f3f6fed6b33657e13db3d7.exe

pid process

4156 74f2109124f3f6fed6b33657e13db3d7.exe
116 74f2109124f3f6fed6b33657e13db3d7.exe

pid	process
116	74f2109124f3f6fed6b33657e13db3d7.exe

pid	process
116	74f2109124f3f6fed6b33657e13db3d7.exe

flow	ioc
12	pastebin.com
14	pastebin.com

pid	process
116	74f2109124f3f6fed6b33657e13db3d7.exe

pid	process
2496	schtasks.exe

pid	process
116	74f2109124f3f6fed6b33657e13db3d7.exe
116	74f2109124f3f6fed6b33657e13db3d7.exe

pid	process
4156	74f2109124f3f6fed6b33657e13db3d7.exe

pid	process
4156	74f2109124f3f6fed6b33657e13db3d7.exe
116	74f2109124f3f6fed6b33657e13db3d7.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

74f2109124f3f6fed6b33657e13db3d7.exe74f2109124f3f6fed6b33657e13db3d7.exe

description	pid	process	target process
PID 4156 wrote to memory of 116	4156	74f2109124f3f6fed6b33657e13db3d7.exe	74f2109124f3f6fed6b33657e13db3d7.exe
PID 4156 wrote to memory of 116	4156	74f2109124f3f6fed6b33657e13db3d7.exe	74f2109124f3f6fed6b33657e13db3d7.exe
PID 4156 wrote to memory of 116	4156	74f2109124f3f6fed6b33657e13db3d7.exe	74f2109124f3f6fed6b33657e13db3d7.exe
PID 116 wrote to memory of 2496	116	74f2109124f3f6fed6b33657e13db3d7.exe	schtasks.exe
PID 116 wrote to memory of 2496	116	74f2109124f3f6fed6b33657e13db3d7.exe	schtasks.exe
PID 116 wrote to memory of 2496	116	74f2109124f3f6fed6b33657e13db3d7.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe
"C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4156

C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe
C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe" /TN Google_Trk_Updater /F
3⤵
- Creates scheduled task(s)
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe
Filesize
506KB

MD5
a249985a824c600f561ff387fe9bdc0c

SHA1
ebf367b6f1c75bc8ad8740758f557c43c20e30c5

SHA256
7e51481ca07f56fd5e91c87c300e318d65d71554422dcb1383fb67cf2ad8d430

SHA512
d7ac7fde3b95c81fcc4b6ab9cf741d2dedfa23946dc1eda7b62b1a81f3d5620a1aa7d5c6647830be45915cb75c2ae30d23252d5939e0154a70dc6aaf5d045e89

Download Submit
memory/116-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/116-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/116-20-0x0000000004F10000-0x0000000004F8E000-memory.dmp

Filesize
504KB

Download
memory/116-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/116-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4156-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4156-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4156-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4156-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download