kinsing | 67d8f5708d32644993611385def901f1f36e57eeaf930a874a6480f87f236d0d

Analysis

max time kernel
96s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Target

2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe
Size

443KB
MD5

4cc96a64340b5ab3c48e61d2d2de632b
SHA1

cd285ea1c2b8d6bf3f788e3437bdcc3de804f19f
SHA256

67d8f5708d32644993611385def901f1f36e57eeaf930a874a6480f87f236d0d
SHA512

0fc73cbbc39753b32acb4baa31c8a5e80604f2111bf691b03e8d9e17e2f9da3bf1ddffd70cb5e6f30129a43e4642aeb1e07da1458d30a14eb00e42ff73d22bca
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BY9K9Llyjuyh/TnD0SVXyT6JKDz1RrgM6wHPhnlV:Wq4w/ekieZgU6MM4aiATMmmwxlMa

Score

10^/10

kinsing loader

Deletes itself 1 IoCs

Processes:

41CC.tmp

pid	Process
1368	41CC.tmp

Executes dropped EXE 1 IoCs

Processes:

41CC.tmp

pid	Process
1368	41CC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe

description	pid	Process	procid_target
PID 1596 wrote to memory of 1368	1596	2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe	86
PID 1596 wrote to memory of 1368	1596	2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe	86
PID 1596 wrote to memory of 1368	1596	2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\41CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\41CC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_4cc96a64340b5ab3c48e61d2d2de632b_mafia.exe 1E72668F5DC9C67346BBF2426FE2B2508B8723D1918276B8F2B9FCE4D095682505476AB06B03EE18B80955D605F7EBC9027BDD27F90347675571F00660406190
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1368

C:\Users\Admin\AppData\Local\Temp\41CC.tmp

Filesize
443KB

MD5
4f71085130d9e27dab123e002af206cb

SHA1
7a1817c10a437853497286093c0d30198705adf0

SHA256
feae11ba959f598de042518880fb29f1f73dc97e21597b90a82e4aea8864f013

SHA512
12e77f7cb00a52e3db5f095649a6ccf9a069b4ececbe4f3ea40ddb63ba83871e98d0f38217a0a55cffaaac4d861d954c1e608a4c2fc2e379e44895bf29ad35d1

Download Submit