kinsing | 426fec334451663204948caea397a56aed58dec43de28c6a4fdaed7f6ce433fe

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kolebot/website/OnlineHile.url
Size

125B
MD5

48ce7b7619f1c60877062ecff59ca963
SHA1

ecd1e7558a4eb86b8e76582f4c9122fe150b8e53
SHA256

165b8e1402c3e526d6956c44faf9b49596faf12c1530b93d373e66cf763648cc
SHA512

6d213b545594dc157a74fe795c203f3ba891de72cac2aa6715a1c6a2365b6f8f4093b844f55001a3197b7e21d5a28bde4ce87f168c85e78e5e23ce5f37bfd32f

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
4496	msedge.exe
4496	msedge.exe
3484	identity_helper.exe
3484	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4496	4372	rundll32.exe	85
PID 4372 wrote to memory of 4496	4372	rundll32.exe	85
PID 4496 wrote to memory of 4252	4496	msedge.exe	87
PID 4496 wrote to memory of 4252	4496	msedge.exe	87
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 756	4496	msedge.exe	90
PID 4496 wrote to memory of 1384	4496	msedge.exe	89
PID 4496 wrote to memory of 1384	4496	msedge.exe	89
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91
PID 4496 wrote to memory of 1916	4496	msedge.exe	91

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\kolebot\website\OnlineHile.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.onlinehile.org/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba3fb46f8,0x7ffba3fb4708,0x7ffba3fb4718
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17989259367775076674,15661536374218755570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
a675854fe08ff9f60c56f59457626acf

SHA1
2c7a96ca67b16b5ddb116b1766e9bc9aed973d58

SHA256
823b698b50ddb1616e0cfa1448c406cd41a84d1da2f71636b435935aa1b21a64

SHA512
b0b1b4666b102cd7fc7f1d70997a3861fcafe6f7f83d141d06f5b7c2bc3af58d11a2caf94bf10a1aedcc9269b2a1202882a6ff5ab10c1b4169e39136590eabbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7514e2b261c48b3fb0aab9d2ac0cd81c

SHA1
b1b4a946108ae841b74b116b6ba82e4b36dbc00b

SHA256
45319deb1ea9cea64bdabe262d953bf408e1e0ea38d39b3af7fffeaa8f81ff4a

SHA512
d44558a08705a7eb511550c890e6f522b88726fc0e9e37550f6075be8afd060672f65741d55841c43071dcfbafe181601a2c9d6973cd3b92c26c92899565ff1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fdad9cb8603b96e19dcd62cb583c5f6d

SHA1
83d99cc418420f5b16395ed33473dd8457cb9a29

SHA256
5cbea0a050e94f0d3ef5ab14db0c65dae4019b6bf594dea0e072fa3b79da4079

SHA512
4adc08975bc1a5a4132d2e165b559da31ede62e501a99aca2ccbd16dbdbe7d863e32b11466d611964bdbc70b22a853848e26be1c5e16d2dbb0c216c0e1d8ecec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
187240411e7a8d290491fc86582e2e49

SHA1
a5207148218ff44ca57824d6d1dec2b250b8ef49

SHA256
ad040b831b92ae8e118b83f4eabe3e363c7d9199d845227ec5e4b4f92e35e0c7

SHA512
d48ccb9cfadec9f2393ccfd68d9439d6871e7af8a287db421c094c38cf62959bd4d414e45089042998fda27929d398f6694072de16f6c9e26e953c9c32a8e0b4

Download Submit