kinsing | 5640ab46f0603910176307bd52d826bc08f84b6d2b3ef3dc4bcd2f605025102c

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:29

Target

2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe
Size

486KB
MD5

6018e11431f1a82ee389a6780dceabc3
SHA1

424dcd038c8ea25f8928b5f5b1f2256351f31523
SHA256

5640ab46f0603910176307bd52d826bc08f84b6d2b3ef3dc4bcd2f605025102c
SHA512

aad2d71af716f6734975caef4c469c9aa935a739cf43abb5962f946b7075a9cdd89599f0d4208f172c5078bff15fed7dcaef45071d4f9592b3400ec9f2f566f4
SSDEEP

12288:3O4rfItL8HPd3iXL2AoanUIao9EcqX7rKxUYXhW:3O4rQtGPdyaTanUno9EcqX3KxUYXhW

Score

10^/10

kinsing loader

Deletes itself 1 IoCs

Processes:

4D45.tmp

pid	Process
3840	4D45.tmp

Executes dropped EXE 1 IoCs

Processes:

4D45.tmp

pid	Process
3840	4D45.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe

description	pid	Process	procid_target
PID 1784 wrote to memory of 3840	1784	2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe	16
PID 1784 wrote to memory of 3840	1784	2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe	16
PID 1784 wrote to memory of 3840	1784	2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\4D45.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D45.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_6018e11431f1a82ee389a6780dceabc3_mafia.exe 26A3206196860093FC4FC5381EA71F970A7F788F3EA4455C042064065CA6B835E5CA6D9A4EB2A7CA6B650F9A3A2870BC2139977ED33A0331A42CD349BF7CCF39
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3840

C:\Users\Admin\AppData\Local\Temp\4D45.tmp

Filesize
1KB

MD5
55ffcfe00c9e88815d8867822c1bd0bf

SHA1
1071cd2ebde24dd25168321ac5463aba7fbcca7b

SHA256
cbd086a5a250d66170e3e7019333de1e273eb4c08598833388ed578ec2b82bd8

SHA512
54b9f4e1dabec2a7374bc3bfe6f25863367b5c4625866759618108847adb6def503bf8f035aae57dd4b169c8f282328badb6132fbe7dcc40c7235e66a3c96302

Download Submit
C:\Users\Admin\AppData\Local\Temp\4D45.tmp

Filesize
278KB

MD5
49c4cd8155848f52b11763869f932139

SHA1
0886bf2d21baa492cef3ac306a8bc2499b657bac

SHA256
a837beef455406c7efc598cdd0c2a1045ee25a3310e90bf3b64fa8a81b95932e

SHA512
103f33ad0fb8457d5aca949e12e8c5edcb5b0f182a1c8d7ac3eadf6e9ac4ba39514a69f938abbcd91a9a780aab206741bca3f802832d603df7d8f24863e9be2e

Download Submit