kinsing | 300fe6224578b1254a43444f7e1783dd608a6c065d4e6089e7560e719fc787b2 | Triage

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Sharing

Report Analysis Logs

General

Target

About.chm
Size

9KB
MD5

ce019bb7fbebc11af169ed3f165ae83e
SHA1

56d309fe66614b110cff0fb9b445943b0d0158e3
SHA256

321d8125b5b7c0b17d47250a9745a477df1094994992171510c5a308a116cf9d
SHA512

390370d15ffd04c8712ee74cfafad2b69d92fea6feb35aefcb5b00add1682b0d59b7c239ced8e7ab160c3a4aa43b781fed366b91b09a21c5f4275b3d5b9be321
SSDEEP

48:CS1QOl0EQRlEFlErlElN5s/wWbQa9jWavVLYHNKkQOFK5HPW/e0:CS1QQZR8Rt0Nk/5vW/

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

3304 hh.exe
3304 hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\About.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...