kinsing | 6b9b930f8f0bce675b0424f3f8c916ceb91faf5509e8f828d122321d729d1b20

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe
Size

344KB
MD5

560bd77bcfcafc5113df6f48ba690540
SHA1

670510ab56d64a18b60ccb3b52feac2a5a9baec7
SHA256

6b9b930f8f0bce675b0424f3f8c916ceb91faf5509e8f828d122321d729d1b20
SHA512

5c251ae9a9c1d70225631733fb57fb50f984df190230545b2302a865752008fb09e36d53bd78572fd82dd9ca9ba8e9db1f4919ca61a8af3b0f6f1f3217309814
SSDEEP

3072:mEGh0oVlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG7lqOe2MUVg3v2IneKcAEcA

Score

10^/10

kinsing loader persistence

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Auto-generated rule 14 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023227-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023220-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002322e-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023220-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023220-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000022043-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000022044-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000022043-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000022043-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000709-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33FF74D7-8240-4646-B438-9347DCCCFBB3}	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33FF74D7-8240-4646-B438-9347DCCCFBB3}\stubpath = "C:\\Windows\\{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe"	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A36AC0A4-9102-4e20-BB1A-4E6290431646}	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}\stubpath = "C:\\Windows\\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe"	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE98E750-937F-4264-A25B-0D0C00B33118}	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE98E750-937F-4264-A25B-0D0C00B33118}\stubpath = "C:\\Windows\\{BE98E750-937F-4264-A25B-0D0C00B33118}.exe"	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}\stubpath = "C:\\Windows\\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe"	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}	{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}\stubpath = "C:\\Windows\\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}.exe"	{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A36AC0A4-9102-4e20-BB1A-4E6290431646}\stubpath = "C:\\Windows\\{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe"	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}\stubpath = "C:\\Windows\\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe"	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}\stubpath = "C:\\Windows\\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe"	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{073C352D-E629-4a3c-82EE-ED06816343D6}	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{073C352D-E629-4a3c-82EE-ED06816343D6}\stubpath = "C:\\Windows\\{073C352D-E629-4a3c-82EE-ED06816343D6}.exe"	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}\stubpath = "C:\\Windows\\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe"	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F53C3930-F924-4c29-A7F9-46F9531A802D}	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87313B54-3E11-4117-9C7F-457B6183AE02}	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87313B54-3E11-4117-9C7F-457B6183AE02}\stubpath = "C:\\Windows\\{87313B54-3E11-4117-9C7F-457B6183AE02}.exe"	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F53C3930-F924-4c29-A7F9-46F9531A802D}\stubpath = "C:\\Windows\\{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe"	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe

Executes dropped EXE 11 IoCs

pid	Process
4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
4028	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe
3148	{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
File created	C:\Windows\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
File created	C:\Windows\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
File created	C:\Windows\{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
File created	C:\Windows\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
File created	C:\Windows\{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe
File created	C:\Windows\{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
File created	C:\Windows\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
File created	C:\Windows\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}.exe	{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe
File created	C:\Windows\{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
File created	C:\Windows\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
File created	C:\Windows\{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
Token: SeIncBasePriorityPrivilege	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
Token: SeIncBasePriorityPrivilege	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
Token: SeIncBasePriorityPrivilege	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
Token: SeIncBasePriorityPrivilege	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
Token: SeIncBasePriorityPrivilege	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
Token: SeIncBasePriorityPrivilege	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
Token: SeIncBasePriorityPrivilege	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
Token: SeIncBasePriorityPrivilege	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
Token: SeIncBasePriorityPrivilege	4028	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4544	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe	97
PID 4048 wrote to memory of 4544	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe	97
PID 4048 wrote to memory of 4544	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe	97
PID 4048 wrote to memory of 2636	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe	98
PID 4048 wrote to memory of 2636	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe	98
PID 4048 wrote to memory of 2636	4048	2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe	98
PID 4544 wrote to memory of 3620	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	100
PID 4544 wrote to memory of 3620	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	100
PID 4544 wrote to memory of 3620	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	100
PID 4544 wrote to memory of 4032	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	99
PID 4544 wrote to memory of 4032	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	99
PID 4544 wrote to memory of 4032	4544	{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe	99
PID 3620 wrote to memory of 4912	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	103
PID 3620 wrote to memory of 4912	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	103
PID 3620 wrote to memory of 4912	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	103
PID 3620 wrote to memory of 4052	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	102
PID 3620 wrote to memory of 4052	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	102
PID 3620 wrote to memory of 4052	3620	{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe	102
PID 4912 wrote to memory of 4472	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	104
PID 4912 wrote to memory of 4472	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	104
PID 4912 wrote to memory of 4472	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	104
PID 4912 wrote to memory of 4036	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	105
PID 4912 wrote to memory of 4036	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	105
PID 4912 wrote to memory of 4036	4912	{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe	105
PID 4472 wrote to memory of 3716	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	106
PID 4472 wrote to memory of 3716	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	106
PID 4472 wrote to memory of 3716	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	106
PID 4472 wrote to memory of 4860	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	107
PID 4472 wrote to memory of 4860	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	107
PID 4472 wrote to memory of 4860	4472	{BE98E750-937F-4264-A25B-0D0C00B33118}.exe	107
PID 3716 wrote to memory of 4056	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	109
PID 3716 wrote to memory of 4056	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	109
PID 3716 wrote to memory of 4056	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	109
PID 3716 wrote to memory of 1924	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	108
PID 3716 wrote to memory of 1924	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	108
PID 3716 wrote to memory of 1924	3716	{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe	108
PID 4056 wrote to memory of 1480	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	111
PID 4056 wrote to memory of 1480	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	111
PID 4056 wrote to memory of 1480	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	111
PID 4056 wrote to memory of 2356	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	110
PID 4056 wrote to memory of 2356	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	110
PID 4056 wrote to memory of 2356	4056	{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe	110
PID 1480 wrote to memory of 4520	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	113
PID 1480 wrote to memory of 4520	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	113
PID 1480 wrote to memory of 4520	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	113
PID 1480 wrote to memory of 4872	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	112
PID 1480 wrote to memory of 4872	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	112
PID 1480 wrote to memory of 4872	1480	{073C352D-E629-4a3c-82EE-ED06816343D6}.exe	112
PID 4520 wrote to memory of 5112	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	114
PID 4520 wrote to memory of 5112	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	114
PID 4520 wrote to memory of 5112	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	114
PID 4520 wrote to memory of 3868	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	115
PID 4520 wrote to memory of 3868	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	115
PID 4520 wrote to memory of 3868	4520	{87313B54-3E11-4117-9C7F-457B6183AE02}.exe	115
PID 5112 wrote to memory of 4028	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	116
PID 5112 wrote to memory of 4028	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	116
PID 5112 wrote to memory of 4028	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	116
PID 5112 wrote to memory of 4792	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	117
PID 5112 wrote to memory of 4792	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	117
PID 5112 wrote to memory of 4792	5112	{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe	117
PID 4028 wrote to memory of 3148	4028	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe	119
PID 4028 wrote to memory of 3148	4028	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe	119
PID 4028 wrote to memory of 3148	4028	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe	119
PID 4028 wrote to memory of 2148	4028	{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_560bd77bcfcafc5113df6f48ba690540_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
  C:\Windows\{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{33FF7~1.EXE > nul
    3⤵
    PID:4032
- - C:\Windows\{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
    C:\Windows\{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A36AC~1.EXE > nul
      4⤵
      PID:4052
  - - C:\Windows\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
      C:\Windows\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
        
        C:\Windows\{BE98E750-937F-4264-A25B-0D0C00B33118}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Windows\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
        
        C:\Windows\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7AE10~1.EXE > nul
        7⤵
        
        PID:1924
        
        C:\Windows\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
        
        C:\Windows\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8AFEE~1.EXE > nul
        8⤵
        
        PID:2356
        
        C:\Windows\{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
        
        C:\Windows\{073C352D-E629-4a3c-82EE-ED06816343D6}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{073C3~1.EXE > nul
        9⤵
        
        PID:4872
        
        C:\Windows\{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
        
        C:\Windows\{87313B54-3E11-4117-9C7F-457B6183AE02}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
        
        C:\Windows\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe
        
        C:\Windows\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{61D27~1.EXE > nul
        12⤵
        
        PID:2148
        
        C:\Windows\{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe
        
        C:\Windows\{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F53C3~1.EXE > nul
        13⤵
        
        PID:1888
        
        C:\Windows\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}.exe
        
        C:\Windows\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}.exe
        13⤵
        
        PID:996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E5A9~1.EXE > nul
        11⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87313~1.EXE > nul
        10⤵
        
        PID:3868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE98E~1.EXE > nul
        6⤵
        
        PID:4860
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F400F~1.EXE > nul
        5⤵
        
        PID:4036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{073C352D-E629-4a3c-82EE-ED06816343D6}.exe

Filesize
71KB

MD5
08f32bdfea2490d1dd1ea21432fcdc47

SHA1
7340be730b366aafa03a53cd4226c97bedef659c

SHA256
00ac7236250e44b6a5af138e0577a25fdbb886d1544ecd9cd8ea36783f1ef80c

SHA512
13eb961a87b853ac53bbecb7d581228d6c654dc331abb511672dd4a195cd893d5c9cdf5596faaabff614aab84d80e38dab41d63a3f3d25ea476125c87580e933

Download Submit
C:\Windows\{073C352D-E629-4a3c-82EE-ED06816343D6}.exe

Filesize
96KB

MD5
b5ed4219929e8be6facd4d4a2dd6fcbe

SHA1
ff179cd1862ceaaa1957ce2e796228616dee5ce4

SHA256
152712028eef91213bd791ee5c5ead91d66cc0b9969bd5ad4c2e4b86c62ed9d5

SHA512
9f62c1a083a12a5b7074246ac641c780577c87fb362eedb180545459b4f8c8f599fd561d7385507edc4b470cb2e6e1b18a00bc2703cc5ebbf3af0b142595b563

Download Submit
C:\Windows\{33FF74D7-8240-4646-B438-9347DCCCFBB3}.exe

Filesize
344KB

MD5
28ef37cade7b1efdc86a481ffc9c96ef

SHA1
cf98cc4d9a5049401cc9270153a7f9dd2da36029

SHA256
38cafd013ee395ed27794ce195489aee570674e1512bed1572edd9d27317484b

SHA512
d53025f4efb5034a6558eec8a9fdb435e2162375e599855e38114524fbd6483d113c33db90c60daf47ed8c6a26dbf7a98515b11399ca0cd08585ad1df09deffe

Download Submit
C:\Windows\{61D279BF-EAF4-4df5-9C72-89B7F2665FF1}.exe

Filesize
344KB

MD5
053b7cfd6ecb9c65433632fd3f476564

SHA1
3d30b4d81bb6df6dd829d794b8d5a98feaa5e178

SHA256
2756b1386f66482f676fb0ec18b0e6bfb00b421928a607436db8ae6c751a8b77

SHA512
bda537984f28b04a70e091ef11a2797149c16b387e1d5501884752fd1d812b81e37207a4b40db0f322ca93d87f7d538ac09d9a71f70c4e55ba97266aad26fcb4

Download Submit
C:\Windows\{6C7772B8-E674-4f37-A1AB-71BF53FA2434}.exe

Filesize
344KB

MD5
1c194d3ff51b945a250be415c17c2c7f

SHA1
9ec8e4b97988412344e012d3b5528b7c59035bd6

SHA256
59bb2e88a6ab77485435b5c6024dd682dc510d9cea23a60b8964354a3449f8f9

SHA512
9d8522d89f4aec3d98efaa803145ddf0337ab561186787808efcb8da40fb45bee83c66f27310632725ff59a0aa9539b070fe688a4681b086e24f7d29fc51e40f

Download Submit
C:\Windows\{7AE10EA7-1F4D-4ca5-9FA4-6DBF1E03E950}.exe

Filesize
344KB

MD5
8eefa48799dc635726f304490931d480

SHA1
1e226d11f370babfb3c72cf125a63b28f9e61642

SHA256
038d868199b8ae5da206c24af4cee25d855e39806a9ff4a57a526c033d6b858a

SHA512
b0d55dd0b1ffbcaf4f2121e1d98ed88737ab41bc833d21a94809d183eac4b5aac83f98cae232ad02a2cd24f4a53d9166afcd7186523d223eda6c0e2bf65d14f2

Download Submit
C:\Windows\{7E5A919D-9D46-4801-8DB3-245A3DB11C79}.exe

Filesize
344KB

MD5
b4c0ae4e1f158c74435d2b4726d34e3f

SHA1
957e0847350af9849e9984fdb8ce37b0ba720cb2

SHA256
37f795fd17943d82b776a32cabf059229961e6569a3d550184529e866232cc76

SHA512
2dd897904c3fc08a14d08e2f943147a40e5a1d84cdd64fe8970303da83a54bcb2c5bf33d3ef6c83acb15fa2d06defc6a82c44c648e624438f771bf04b745f2fd

Download Submit
C:\Windows\{87313B54-3E11-4117-9C7F-457B6183AE02}.exe

Filesize
344KB

MD5
12b4fa7829c631d9630a41d3d7b1bbc7

SHA1
8fe29dbf09e54bc18f241e72a5828887dc508ea6

SHA256
5a058907ea3eb13b6a6512c53a38f5b3c6bcaa8ce5f502913a16a09a8445ea1f

SHA512
35093bb14b7f2a5610c8323e114bfb654ed8bc9feedf16e9189e100b1421d1285794964460284fcb0407457ca13661f90e87ad39d81b19088a40d879672b63a8

Download Submit
C:\Windows\{8AFEE927-4312-45b4-86F7-DEF4189B3E8C}.exe

Filesize
344KB

MD5
85211c5be5abc8d8a3667aa7cac3727e

SHA1
b8ef71d76f49dacee20bbaeec6ffa562a12a8b9b

SHA256
82743099ffe728db2ef4f5ab4cba700f4efd969b1b3b17a08271fe694407de8d

SHA512
c4abb301c67bdf1d9df570b06e1b58302c0b441fa1cf893d71bc2457abe6100f4f341856b4dbbc1be976b36111a4ca62d8e8e10b49968acd2dc381088e5afd60

Download Submit
C:\Windows\{A36AC0A4-9102-4e20-BB1A-4E6290431646}.exe

Filesize
344KB

MD5
49a5b6c28b90d60d6f781cf8429af135

SHA1
6a858e41b7de4dfa1ac3fb6bb2958a9926c377c5

SHA256
f3cfccf4373ec5035605648e6e15f75b3555e00bef8bdd8ca7b7eefe8f02a0f7

SHA512
97a5bff487a113b959d5b2f7250f2f6a2e735a34227c27766fe098899f75307f410d882b018392798b276e1da67370a7955993cab63e49ecc57c38487c67a272

Download Submit
C:\Windows\{BE98E750-937F-4264-A25B-0D0C00B33118}.exe

Filesize
344KB

MD5
e8c7270a751d0adf29fa4339dbdaf646

SHA1
4a9c1b994598168fbd5063024709c551c9aca615

SHA256
e1a532f3294b87275d14627cda3363a6054f0f6255082542932b517ca236fcdd

SHA512
97f1aeeaf6a60c66965a4cd2ce15f94b117f737318ed4046ec1461f85a65bbb4f03b216bc27cae255b5fa1ba950c509e90ed746815d10cd19850fefe73c6be7d

Download Submit
C:\Windows\{BE98E750-937F-4264-A25B-0D0C00B33118}.exe

Filesize
285KB

MD5
f4518a6402377f32c8a5fec3cb6eee02

SHA1
5e8049021a2bbac7060c5d33eda548b4ecb20950

SHA256
2374731bdcc39b1ce25065db412b6e4bb3a4a319d42ec8c2e81e8779bf1e1ade

SHA512
2725f11a0f0bf4290966bd01762f72c866d73d24d4fcddbd731e8a8196301ad3c2bed91009accb5802ac8c961737d9e2239d6f7b79dbfe61110a1161ac7606df

Download Submit
C:\Windows\{F400FBEF-AADC-4b2e-B8AB-207145FD3F55}.exe

Filesize
344KB

MD5
374dd43a9ebcad2f9b0f712ba1765e58

SHA1
909d4187a49ae9aa302140594b5acd25105f9b93

SHA256
73b2b15e59de882f145b43ca60e7db4261bf8410ad4b93019fceb1d098957464

SHA512
0460ad23b4a36284f002a1f7281ac6f3375dfe7f235b305b4238168d88aefb2e45309f3d50b8579cf775032c441c3bd08e8f0273e51483a0db72b0c0436f9565

Download Submit
C:\Windows\{F53C3930-F924-4c29-A7F9-46F9531A802D}.exe

Filesize
344KB

MD5
59b4e1c91a925fb5abdc5ba2647416aa

SHA1
77c12e669b87eaddd9ec89ad0c26e1ab37c5c5cf

SHA256
0a4968ad7638304ddab91afa32336b86b52f72e53c561481a73a9d603bf392f9

SHA512
9ccbade0f91424546dbbe4daf263f00c9e9058a43168f910a8ec9b4254bd366b9d08628af9c7e24bc5a4f4378464fb69ba12b850dfdf1e3c971aa507412e0ff3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads