kinsing | 4e042b9356844d81d04cb58c2a516d62966b0ac1e90c3dee53a0ed0323ef84a1

Analysis

max time kernel
88s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe
Size

99KB
MD5

561a19f1368139296bbd40a9711f04d7
SHA1

f11aedfb20221a159604336012682a6146278686
SHA256

4e042b9356844d81d04cb58c2a516d62966b0ac1e90c3dee53a0ed0323ef84a1
SHA512

12857020a9f66aa5bc9ec7905bd0b96355d0b1409c339157e16e4eefb1711ba8af77aa10fce2628fad1b0b5861d8a4a649957627ddd4809d6b3cd4dfce551cfa
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2+:xj+VGMOtEvwDpjubwQEIiVmkxv/i

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023210-13.dat	CryptoLocker_rule2
behavioral2/memory/2888-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4684-54-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0007000000023210-13.dat	CryptoLocker_set1
behavioral2/memory/2888-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4684-54-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023210-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2888-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4684-54-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exemisid.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid	Process
4684	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe

description	pid	Process	procid_target
PID 2888 wrote to memory of 4684	2888	2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe	87
PID 2888 wrote to memory of 4684	2888	2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe	87
PID 2888 wrote to memory of 4684	2888	2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_561a19f1368139296bbd40a9711f04d7_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
100KB

MD5
f4f4bc55e203280b3d64b1b06f249116

SHA1
f3bc0670ca20346ce12b070772e4c13a90bee59b

SHA256
36b13b1472030f06f45a1bffee5109118857cff5ded7ecdf81f1e0d8a99f7bd4

SHA512
c1e44fb13a0b5f35887dfc032e089f126e2f714663e8b10b82e5f37731061ac82e353ebdfbe2d22082e48a5d3403550a4a49bb7e97801f43ed29f3952eaf27dc

Download Submit
memory/2888-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2888-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2888-3-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/2888-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2888-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4684-19-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/4684-25-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4684-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download