kinsing | b44bd2193f4abb87d3ed04a56f1da78a51257b5063e7298b8b58325154d9f28e

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Target

2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe
Size

486KB
MD5

49391cacd3db9af1e71be0b61d9171fb
SHA1

a3c2346451f5326a96192e5fcde5a55d5a7f785e
SHA256

b44bd2193f4abb87d3ed04a56f1da78a51257b5063e7298b8b58325154d9f28e
SHA512

6fe0d1218a3bb7c167cfcfac19523b747362ef8f47cd4dabdcdbc0450b5b50185affe4a8ac251d97783535cba390d27d2b46b6294cf9e7a65c4c19b7b58b40e3
SSDEEP

12288:3O4rfItL8HPdn/4KTwgH6WpSn7aDQjmw7rKxUYXhW:3O4rQtGPdARgHS1D3KxUYXhW

Score

10^/10

kinsing loader

Deletes itself 1 IoCs

pid	Process
1628	7D6D.tmp

Executes dropped EXE 1 IoCs

pid	Process
1628	7D6D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1628	2492	2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe	86
PID 2492 wrote to memory of 1628	2492	2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe	86
PID 2492 wrote to memory of 1628	2492	2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\7D6D.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D6D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_49391cacd3db9af1e71be0b61d9171fb_mafia.exe 3AE47A72E99DD1018ABD4FD0CBC8FDC0407CA116FF68F893203BCC2E76B1F99E123150FC22C560D1D418F1285CC7631B5212316A1AA981071205A9372D7A2913
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1628

C:\Users\Admin\AppData\Local\Temp\7D6D.tmp

Filesize
486KB

MD5
960e0392594a2061e3906fafebbd76a7

SHA1
4f1b1e94d8da34d5262f7ad93178b120b3930c89

SHA256
28ba36dada3c2022579c37418ff111f80e66b3fd09c7c845c3c5dc33b9332292

SHA512
d4f4350b27893a5a7a3f0f7e0e0e46fbc2d531fba6444db9e96d1ec354ceba8b2204aeff67f2dd2faa5cfa0a2971fa69598427028783fd7e09648be3ddfcbd63

Download Submit