Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 16:26
General
-
Target
74f75c14b95bb67375199a61a861623e.exe
-
Size
200KB
-
MD5
74f75c14b95bb67375199a61a861623e
-
SHA1
2f36a4de064dac3b4ce365db7501fccd3680cf1e
-
SHA256
12d1fc95264c141fd2eaf32c0277631e868002fd443deb40eafe43dfc874f875
-
SHA512
980a0a8c55ad64de6b510cb69a60e489efd31a32e564ede48505a8c90233fd83f7f86fb5289dc1601b1d6fed7afe828a6e3c4d55737ad70c8f8c4b2f4f318d5d
-
SSDEEP
3072:8HJEPV9CNVgBY3zw4BvmSe3FgB7RRJmJKE1MYQofxqIJxyPqFHG2hnWZMzyz6Z:8GPV9CDgCzDCFG7XJmJlNx71FRnW56Z
Score
10/10
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f75c14b95bb67375199a61a861623e.exe"C:\Users\Admin\AppData\Local\Temp\74f75c14b95bb67375199a61a861623e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5020 -ip 50201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5020-0-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/5020-1-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/5020-3-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB