kinsing | 156804f2cb2aa2929a317836c58a7b6bd84cd311192a1cd1b5cdbfffd24e271e

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe
Size

39KB
MD5

63847b10ddcb5fc2e1b1385fa1bd6f56
SHA1

87de33a92cc16754cafdd3dd71f41939b6853a88
SHA256

156804f2cb2aa2929a317836c58a7b6bd84cd311192a1cd1b5cdbfffd24e271e
SHA512

9a5f04d965932d0e5258cc22e689dabef9047cdc74f18962a5225409b8afa2902ef0f4fd927d2bf5c180c1a961a24b47ed503588622f3f97633d9bb49df7e066
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQL3bTo:ZzFbxmLPWQMOtEvwDpjLeU3w

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022480-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
3276	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3276	2696	2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe	89
PID 2696 wrote to memory of 3276	2696	2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe	89
PID 2696 wrote to memory of 3276	2696	2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_63847b10ddcb5fc2e1b1385fa1bd6f56_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
8dcd10cfeb5bfc0c6b221139de7ef1e9

SHA1
d80b7e0fbaa7097132351133a4c5ebd42f4ffdd5

SHA256
47de8c60f74196b60d84064b1441c07937100ecf9d4cb0984b6739467eed60a7

SHA512
1f5b3eb19acfefa244d969d155bf26e1d2585b0d63ca377627cfa30cfb06a6a9a96af56886faa2e6f30cc8b7c955f0c2c67542d225b0f5d4446538166d1b5f8e

Download Submit
memory/2696-0-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download
memory/2696-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2696-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2696-3-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/2696-21-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download
memory/3276-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/3276-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/3276-22-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download