Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 17:29
General
- Target 2024-01-25_5a200367c89d61ee380e45a7abb4fedf_mafia.exe
- Size 465KB
- Sample240125-v2l4dabff7
- SHA256 63b7f0f294538eb58065b991c6cba99e6960d2a2612608d4726f911f330aee8f
Malware Config
Signatures
- Kinsing
Kinsing is a loader written in Golang.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_5a200367c89d61ee380e45a7abb4fedf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5a200367c89d61ee380e45a7abb4fedf_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_5a200367c89d61ee380e45a7abb4fedf_mafia.exe 703D5371BCD15B4881D963271D9595C0DE4EC8943154EDE35B7EF1C40BB392B1C5F871621D6868D94D1C6F3CE7EFD24600274920B1CE78627535830D74107E602⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-01-25_5a200367c89d61ee380e45a7abb4fedf_mafia.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
2024-01-25_5a200367c89d61ee380e45a7abb4fedf_mafia.doc
4759.tmp
ExcludeDictionaryEN0409.lex
memory/3452-24-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-30-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-17-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-18-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-16-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-21-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-20-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-19-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-22-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-23-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-25-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-27-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-26-0x00007FFBE7280000-0x00007FFBE7290000-memory.dmp
memory/3452-14-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-15-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-29-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-32-0x00007FFBE7280000-0x00007FFBE7290000-memory.dmp
memory/3452-31-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-28-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-13-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-54-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-55-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-56-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-75-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-76-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-78-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-79-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-80-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-77-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp
memory/3452-82-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp
memory/3452-81-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp