kinsing | 6a394bdb01917d9ee7dcddc9bf20fc49a817dc3c145ad3cef9119b626161c2f4

Analysis

max time kernel
86s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe
Size

49KB
MD5

551d348462912a2cfa84137fe5e59b77
SHA1

a6c524bd7cbf523e86b61868fc23545e019fb29f
SHA256

6a394bdb01917d9ee7dcddc9bf20fc49a817dc3c145ad3cef9119b626161c2f4
SHA512

78ccdc6a7f5f1ad1dfc0859b350f3d2a19560b1b3a5b4be2dfc638ffa4ad2024d3c26ca56a502ace27f216cc637b7baee7bd9f492c4a07a364a27948e0494148
SSDEEP

768:btB9g/WItCSsAGjX7r3BPOMHoc/QQJP5wjvaHYwiqu:btB9g/xtCSKfxLIc/E1au

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

3064 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3064	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe

description	pid	process	target process
PID 4360 wrote to memory of 3064	4360	2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe	gewos.exe
PID 4360 wrote to memory of 3064	4360	2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe	gewos.exe
PID 4360 wrote to memory of 3064	4360	2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_551d348462912a2cfa84137fe5e59b77_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4360

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
49KB

MD5
a44901e5a3aac6c2ff069d9a2a2375d3

SHA1
a995b138836f5ac5006e9cf2f7c909c5820ed5a0

SHA256
2a0d7a4e1f8a7049f247c65b06382b7122bbfe02430c0b0e935de53bebfa7378

SHA512
10042041b75bff5c8685e3bcd3ba2d4580e74db87bba41dc6bac15f5a21fbedb23bc47307ee62722a5c2c33bde8b405d7977add5424a05647676784e2e4ae77b

Download Submit
memory/3064-25-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/4360-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/4360-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4360-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download