kinsing | 578928c21365636a5901841722431bc78f5c13b31ccc7cf81a7ead52f9db8457

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/dlhelpdl.exe
Size

129KB
MD5

af636418ff8f6b0c1af960a999a8911a
SHA1

90198f23bd13b1d3692b077b82806bcdb6159a3a
SHA256

4ea3e48f8525aa98a957bfb472e81489cbd2fcf17e7004d8515493bcf7919f46
SHA512

25d44b519b0f1b490bd23f6d59abd11213894a992552b5d2416a0b8260501e4f6e53def651bbf815961d38ae2f3aa9b39295b96af98f26ac34bd66552ec638f8
SSDEEP

3072:sgXdZt9P6D3XJw9EdzQIJYToTkNhDmvKyOuS1OV82MW48EOkNhDw:se34yadz2TTDmvKy7S1OV82MpFDw

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Loads dropped DLL 2 IoCs

Processes:

dlhelpdl.exe

pid process

5000 dlhelpdl.exe
5000 dlhelpdl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5000	dlhelpdl.exe
5000	dlhelpdl.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dlhelpdl.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dlhelpdl.exe"
1⤵
- Loads dropped DLL
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw6487.tmp\inetc.dll
Filesize
24KB

MD5
1efbbf5a54eb145a1a422046fd8dfb2c

SHA1
ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

SHA256
983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

SHA512
7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

Download Submit