kinsing | f28dd63eddcbd820da730ecbf347e510896a61083aca0e130125fd8f2bd4b84a | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:16

Sharing

Report Analysis Logs

General

Target

74f2caea84147cbc131eb3fa5fa2719c.dll
Size

23KB
MD5

74f2caea84147cbc131eb3fa5fa2719c
SHA1

eff81ce56ee2739e39b0dc980e9ec3e4a4d17cd0
SHA256

f28dd63eddcbd820da730ecbf347e510896a61083aca0e130125fd8f2bd4b84a
SHA512

b207f67ff1403070501c400f159d80ddd700a58799b7c0e86e20334c0a62fb325bbc81a01c7063e6a11ce9316c33a14c60974cc36707c6cbbf50a8585947c6b7
SSDEEP

384:MpKnogMkg01uHAHuuHHrLXGC5LT5MBXHIGf5iIv:MN5yqC5LT5mXHD5lv

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4852 3448 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4544 wrote to memory of 3448	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 3448	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 3448	4544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f2caea84147cbc131eb3fa5fa2719c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f2caea84147cbc131eb3fa5fa2719c.dll,#1
2⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 75080
3⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448
1⤵
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3448-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download