kinsing | 7d1b9014d1057d105a9ad214332b5cafb0e419c788496f411bcbc96bb2218e2e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe
Size

39KB
MD5

444bd49b2caa13206faacbd1871ed984
SHA1

d66856198d20cac4f7af2699bc073f6ae187ac70
SHA256

7d1b9014d1057d105a9ad214332b5cafb0e419c788496f411bcbc96bb2218e2e
SHA512

329c4e31aeb42a0b7721b974920ee255b3e6c4ba349f06d0fa5d2f841fe8d73c572c4c5484c873c6f4dee5c69f0cdaf99065a5870ff7895a447d18519819cb20
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQL3bTB:ZzFbxmLPWQMOtEvwDpjLeU3J

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2252 misid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2252	misid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe

description	pid	process	target process
PID 4560 wrote to memory of 2252	4560	2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe	misid.exe
PID 4560 wrote to memory of 2252	4560	2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe	misid.exe
PID 4560 wrote to memory of 2252	4560	2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_444bd49b2caa13206faacbd1871ed984_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
39KB

MD5
557bda6ef4b9908fe0f53a61eeaa9ae0

SHA1
826f1e213217441035729cd7d41a17f6e864ccf2

SHA256
b1c9baa34c6fc2a7d601c2c85111804d46ea8b8f4f28a69073b4d4c294908dd7

SHA512
32b78cdd9735e2121f89971368ea83631c80bde4a7ca4c1e1586ae6b00876206005c3027b06e2755080b69a59c8e1d3c2af6b606d4a2cfd1546ef2014a48d81e

Download Submit
memory/2252-18-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2252-20-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2252-25-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4560-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4560-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4560-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4560-3-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4560-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download