kinsing | 86aae9883aa73e79cb571f3eff548f3c31f225db13a01b0a9f8de92c7a384c9b

Analysis

max time kernel
93s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:19

Target

74f42c6a3baa806243b8f0c9155e2b84.exe
Size

82KB
MD5

74f42c6a3baa806243b8f0c9155e2b84
SHA1

41aa7d0b4e0f2e2108e402ff41c0f651f45253f2
SHA256

86aae9883aa73e79cb571f3eff548f3c31f225db13a01b0a9f8de92c7a384c9b
SHA512

2e99d1b53e81a62bb200461781ce74e2fa6ee154bd8c24cfb2eb154ad2ac205ef2865dd48bb3e0f78b1999c034bbfaf016d57bacaa467cd3bba7b4c9631a86b2
SSDEEP

1536:Q13X0P/eR9hYpfQgUSr+5djCbkQhn5YPphNolGKv:Q1nE3US65lCbT+hhGos

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

74f42c6a3baa806243b8f0c9155e2b84.exe

pid process

1896 74f42c6a3baa806243b8f0c9155e2b84.exe
Executes dropped EXE 1 IoCs

Processes:

74f42c6a3baa806243b8f0c9155e2b84.exe

pid process

1896 74f42c6a3baa806243b8f0c9155e2b84.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

74f42c6a3baa806243b8f0c9155e2b84.exe

pid process

3172 74f42c6a3baa806243b8f0c9155e2b84.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

74f42c6a3baa806243b8f0c9155e2b84.exe74f42c6a3baa806243b8f0c9155e2b84.exe

pid process

3172 74f42c6a3baa806243b8f0c9155e2b84.exe
1896 74f42c6a3baa806243b8f0c9155e2b84.exe

pid	process
1896	74f42c6a3baa806243b8f0c9155e2b84.exe

pid	process
1896	74f42c6a3baa806243b8f0c9155e2b84.exe

pid	process
3172	74f42c6a3baa806243b8f0c9155e2b84.exe

pid	process
3172	74f42c6a3baa806243b8f0c9155e2b84.exe
1896	74f42c6a3baa806243b8f0c9155e2b84.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

74f42c6a3baa806243b8f0c9155e2b84.exe

description	pid	process	target process
PID 3172 wrote to memory of 1896	3172	74f42c6a3baa806243b8f0c9155e2b84.exe	74f42c6a3baa806243b8f0c9155e2b84.exe
PID 3172 wrote to memory of 1896	3172	74f42c6a3baa806243b8f0c9155e2b84.exe	74f42c6a3baa806243b8f0c9155e2b84.exe
PID 3172 wrote to memory of 1896	3172	74f42c6a3baa806243b8f0c9155e2b84.exe	74f42c6a3baa806243b8f0c9155e2b84.exe

C:\Users\Admin\AppData\Local\Temp\74f42c6a3baa806243b8f0c9155e2b84.exe
Filesize
82KB

MD5
3876dc34a7eac6ddbb23139241763139

SHA1
566a995771a689589b36e982885c9bf5bd976491

SHA256
31826913c5df5d20638113c04484b34db78529bbb486aa04da325175172dd321

SHA512
3e8e78fa3b5bf89f8365995e11aa0a04c1f7da48b22003a3e571d1d9e9d9edf66104cffac0dbf7738c43d7036eea894477ec5729d1e563851820a78ebd150b5d

Download Submit
memory/1896-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1896-25-0x00000000014F0000-0x000000000150B000-memory.dmp

Filesize
108KB

Download
memory/1896-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1896-16-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/3172-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3172-1-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/3172-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3172-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download