kinsing | 99115734cd54abadcb5b7d355e627f2b1e02ab18c8d0a70590270581d9e09e13 | Triage

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:15

Sharing

Report Analysis Logs

General

Target

$R0.dll
Size

94KB
MD5

77eacb0a6a9d18299fb07b7d78354bb2
SHA1

ec2599939d8c7e6fbc313ff5c42d037688d6927a
SHA256

1990244466872381b02a75749c782334fa933661fd545da5cb383ca3447023d7
SHA512

70a925395b5a20bdb7ad4d01104475e897c05d256785ff3cff62c7b94ee2bb29712b400b0158f745ae6aefc8a06025d26d6186d712702f942c427f24eae9a4aa
SSDEEP

1536:F3mnUAWBo8Ny8BFvI/mjL1nTAHW4JTjZT3tCwlWltpsWr1yjqORrSxyrTWDT23MJ:FTy8BFv9VnQTNAwlihpGKyry23M

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 3320 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4520 wrote to memory of 3320	4520	rundll32.exe	rundll32.exe
PID 4520 wrote to memory of 3320	4520	rundll32.exe	rundll32.exe
PID 4520 wrote to memory of 3320	4520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R0.dll,#1
2⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 612
3⤵
- Program crash
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3320 -ip 3320
1⤵
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3320-0-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/3320-1-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/3320-2-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download