kinsing | 300fe6224578b1254a43444f7e1783dd608a6c065d4e6089e7560e719fc787b2

Analysis

max time kernel
106s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sdpig.exe
Size

125KB
MD5

1c0356a4d34f36e2ee3cba5ab3aaabd8
SHA1

13c218d5205bcd2d0b244278787629d6f4ee842e
SHA256

df8fc44f5b858f79a9cc033b6245e88aa829f057ad077aa379ada32dd4889434
SHA512

fb098eb6ed3dde834247eab7af2a5cb1644fdeaa5030e44d80d37dc898145925f4162a836499619d46bbf44fbe9a97d902f1aa69e30b1f3ee7c8fe44c30198ef
SSDEEP

3072:8sv1gkIVWIkWdn4V/nfQWIjfJ1AZDHuEz3BHG0x+:UhWJWd4UjR+ROEz

Score

10^/10

kinsing discovery loader persistence

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

sdpig.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation sdpig.exe
Executes dropped EXE 1 IoCs

Processes:

Search.exe

pid process

3132 Search.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeSearch.exesdpig.exe

pid process

4240 regsvr32.exe
3132 Search.exe
2708 sdpig.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	sdpig.exe

pid	process
3132	Search.exe

pid	process
4240	regsvr32.exe
3132	Search.exe
2708	sdpig.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Search.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MoveSearch = "C:\\Program Files (x86)\\wsearch\\Search.exe"	Search.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 24 IoCs

Processes:

sdpig.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wsearch\sysadInfo.ini	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\allverx.dat	sdpig.exe
File created	C:\Program Files (x86)\wsearch\mUninstall.exe	sdpig.exe
File created	C:\Program Files (x86)\wsearch\SearchM.dll	sdpig.exe
File created	C:\Program Files (x86)\wsearch\SearchM.dll.tmp	sdpig.exe
File created	C:\Program Files (x86)\wsearch\Mouse1.dll	sdpig.exe
File created	C:\Program Files (x86)\wsearch\mupdate.exe.tmp	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\Search.exe	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\mUninstall.exe	sdpig.exe
File created	C:\Program Files (x86)\wsearch\mupdate.exe	sdpig.exe
File created	C:\Program Files (x86)\wsearch\Search.exe.tmp	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\SearchM.dll	sdpig.exe
File created	C:\Program Files (x86)\wsearch\sysupdate.ini.tmp	sdpig.exe
File created	C:\Program Files (x86)\wsearch\allverx.dat.tmp	sdpig.exe
File created	C:\Program Files (x86)\wsearch\Mouse1.dll.tmp	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\Mouse1.dll	sdpig.exe
File created	C:\Program Files (x86)\wsearch\mUninstall.exe.tmp	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\mupdate.exe	sdpig.exe
File created	C:\Program Files (x86)\wsearch\Search.exe	sdpig.exe
File created	C:\Program Files (x86)\wsearch\sysupdate.ini	sdpig.exe
File opened for modification	C:\Program Files (x86)\wsearch\sysupdate.ini	sdpig.exe
File created	C:\Program Files (x86)\wsearch\setup.tmp	sdpig.exe
File created	C:\Program Files (x86)\wsearch\_uninstall	sdpig.exe
File created	C:\Program Files (x86)\wsearch\allverx.dat	sdpig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 46 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\0\win32\ = "C:\\Program Files (x86)\\wsearch\\searchm.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CLSID\ = "{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\ProgID\ = "SearchM.Com.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\ = "SearchM 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1\CLSID\ = "{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\wsearch\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\ = "{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\TypeLib\ = "{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1\ = "Com Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\ = "{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ = "ICom"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\ = "Com Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CurVer\ = "SearchM.Com.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\VersionIndependentProgID\ = "SearchM.Com"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\ = "Com Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}\InprocServer32\ = "C:\\PROGRA~2\\wsearch\\searchm.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchM.Com\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ = "ICom"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}\ProxyStubClsid32	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

sdpig.exeSearch.exe

pid process

2708 sdpig.exe
3132 Search.exe
3132 Search.exe
3132 Search.exe

pid	process
2708	sdpig.exe
3132	Search.exe
3132	Search.exe
3132	Search.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

sdpig.exe

description	pid	process	target process
PID 2708 wrote to memory of 4240	2708	sdpig.exe	regsvr32.exe
PID 2708 wrote to memory of 4240	2708	sdpig.exe	regsvr32.exe
PID 2708 wrote to memory of 4240	2708	sdpig.exe	regsvr32.exe
PID 2708 wrote to memory of 3132	2708	sdpig.exe	Search.exe
PID 2708 wrote to memory of 3132	2708	sdpig.exe	Search.exe
PID 2708 wrote to memory of 3132	2708	sdpig.exe	Search.exe

C:\Users\Admin\AppData\Local\Temp\sdpig.exe
"C:\Users\Admin\AppData\Local\Temp\sdpig.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 "C:\Program Files (x86)\wsearch\searchm.dll" -s
2⤵
- Loads dropped DLL
- Modifies registry class
PID:4240

C:\Program Files (x86)\wsearch\Search.exe
"C:\Program Files (x86)\wsearch\Search.exe" us
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wsearch\Mouse1.dll
Filesize
64KB

MD5
23dc474fa7d3f168893a0636ec39e8b3

SHA1
1d20d251dde02aaa1b34c8681f7a2f60b5af98cf

SHA256
b7063981dc266732e4cc464a07f2eca1e2b0aa5cb8d792199051bd7771a0661a

SHA512
75e43e5963b07da4550416593453557a789041f5a662071de59a49f0cffa8fae748b1ab02f464f24a8facdc078923834b0a4ee23309b6c7438a06ba2ffe47097

Download Submit
C:\Program Files (x86)\wsearch\Search.exe
Filesize
88KB

MD5
610595ff326d38e997796d9725c1db1c

SHA1
a2c4e29148d1b2a3cfc4f88938a39d60791186d4

SHA256
983652684d3cc24262fdcc587f3f2a7c1e2118b3d7ac4ee760d876a1ef03a86e

SHA512
021d063aeb23134c2332986c0a800c64e7a9f660018f3ec5ce1f5e7f487de6cf6b329908869a01b20426cc119c90a3daa880b82bbff86587eba5aaa7538e4a43

Download Submit
C:\Program Files (x86)\wsearch\searchm.dll
Filesize
32KB

MD5
1347396bc1c22564878cb94f3b810404

SHA1
d92d425ba15404c081a2e597ebdd74ac7cda17f1

SHA256
c928218d0244e1c8f8b78ae474c0d8805d1ab1033ef437dbec60c730993de6c9

SHA512
a37f1637ed55cff8280b790632f023cd4c3b6bdf98eb5d95e4a2a0aaa6a56e2e2ba48ca1779c8cbf92202304ff3dbc6627aaa09bb4a557e419830c5bda15c238

Download Submit