Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:31
General
-
Target
2024-01-25_82a2b4cd281ab7846611643e00925108_goldeneye.exe
-
Size
168KB
-
MD5
82a2b4cd281ab7846611643e00925108
-
SHA1
ab2bef54ffba61ef123055730d5f9cac7c1b2138
-
SHA256
7cbc4d6e0c01be66e067f901ea31c8fdd072721971f9ff6d020e4cacbd8e2e54
-
SHA512
12f31160b0379c695c8eebd94b95717879a2cadecee8454a67d1b0269d671f8f758aa7ad7e329591761f8039f8ab2d407f87015d100c229d6b8b5d6e0aefd887
-
SSDEEP
1536:1EGh0o7lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7lqOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Auto-generated rule 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_82a2b4cd281ab7846611643e00925108_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_82a2b4cd281ab7846611643e00925108_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E635EA02-FFFE-4cba-9E01-7AEFEED2F762}.exeC:\Windows\{E635EA02-FFFE-4cba-9E01-7AEFEED2F762}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FF81597-1C6F-41ad-8141-3D9A87E92214}.exeC:\Windows\{0FF81597-1C6F-41ad-8141-3D9A87E92214}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C83682E7-B91B-4868-B1AC-EDDC26E44CC7}.exeC:\Windows\{C83682E7-B91B-4868-B1AC-EDDC26E44CC7}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFAA1936-54A4-4209-A3F4-6968C197C43F}.exeC:\Windows\{DFAA1936-54A4-4209-A3F4-6968C197C43F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{345B2311-85CC-40fd-ACB3-D650820F0C6B}.exeC:\Windows\{345B2311-85CC-40fd-ACB3-D650820F0C6B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56BACB84-B96C-4d2f-A87D-691A29645D5A}.exeC:\Windows\{56BACB84-B96C-4d2f-A87D-691A29645D5A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7171C8F6-2C58-4c1a-9782-78BDAFC46DC9}.exeC:\Windows\{7171C8F6-2C58-4c1a-9782-78BDAFC46DC9}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{304AFF06-B0B4-4df9-97B6-C5DD0458CB5E}.exeC:\Windows\{304AFF06-B0B4-4df9-97B6-C5DD0458CB5E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0519B459-C133-407a-8BF7-9631A0AE8D57}.exeC:\Windows\{0519B459-C133-407a-8BF7-9631A0AE8D57}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3B528F6-8DFC-42cd-8435-1126B41066BA}.exeC:\Windows\{B3B528F6-8DFC-42cd-8435-1126B41066BA}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9236D06D-405B-4cce-A3AF-F71CA9745CC9}.exeC:\Windows\{9236D06D-405B-4cce-A3AF-F71CA9745CC9}.exe12⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3B52~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0519B~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{304AF~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7171C~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56BAC~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{345B2~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFAA1~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8368~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FF81~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E635E~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD574847ce7fbdc36fe1efb96744a248a58
SHA1c4d82404b7631ee69421e1d64ecb4065c635b016
SHA256e552fbf83933b8163078ce1b2a280d074cebbfde5c29d6ad195ed7d405178b7b
SHA51222de10df27483bea4831814b67236f692817ec8bc8b9d874597d54fd5a3450d7f78b93ca51e3d364ac544a8cdf3dd95c224eb7056c74f68a60215cc10c7ff7d0
-
Filesize
168KB
MD5dfaae9d99804e2b795919c3f52216b42
SHA1c34f7d209a9b690bf5ea36e36c2aacda71681449
SHA256600ba21c45789ea3263c47802844c13b8a7dfd72339ca099b4ba480d456ccf60
SHA512e5deca87d6f17a125c994ad20793b65c64c5a4bba0b49dabbae8d55fa6c92d7ddd8494b36cc5ba8aa116e6d20f1e29fb27ce7c4f857d9b6d64c761721f4e0250
-
Filesize
168KB
MD53d5d196f86cc08010d95e5a9f80f1053
SHA15e069b77f39a6da52dea9f119b0953b393a748e6
SHA256ed30ab9adc68da5f6e5e47caf83b3fdcb90ddc17714308c7b5ae59990b675da2
SHA512fa9245e0f357d21bbd400b614d288d1fdae4d6a843c45bab32866f7d8291aaaf99e66f9c2a5cae40abdab3642eae8e7ecfe4353911c14f1b2fcd87affcda7b1e
-
Filesize
168KB
MD5d538a071798692e137e3fb81c8c6014f
SHA125fc81fb986c2ebaa307273f461e668828071237
SHA256a410652778d71bc13ffb45e6fcd0de901112300e38ccf97103f4636605fe4c78
SHA512572ef50a62ca7068fd04472ca5bd83b20a674b5e48d60b3811da4abb890904789a98578492886fc35afd177dc8d3dec0405ea8e5a36dbc8d2fb107b560613549
-
Filesize
168KB
MD5d62140265ff48530e57177cfe50119e2
SHA14c73e4a8ea8630737e7551e610a0811686a69fd8
SHA2564ce2677e62c2000a53797c722c59cd76b9cfab89ed6b068758d9a195f59d94b8
SHA5129bad2284a60278443b0641ac9dd384ea79957136f8d242f3d817149f09517c38c0d771f70870e09ed6ee6528bfc72b401f07e5babb8f8e75793989617a63ec21
-
Filesize
168KB
MD5348af5267597cd59d0696f214c227d5e
SHA1d3a23031153b6451ee853510f28e6fd395b8462c
SHA256fb55ea5eb15e2fef711642ceaf93afcd28c01aa44c51bfd686e219c5fd2774da
SHA51237c6941f71cc5d0ef994345184df14bb6b2fa9249d47347c2e87950ad8377e4e18fc67c057964b978711843da110c2be0369d029c5045a1a0ac5b9f514ef4e9e
-
Filesize
168KB
MD5a504990bc15f986c2320e27c25f05d15
SHA17b80ca27d11f4f09aeb67875c5672bab4f080b61
SHA25693404d6b6e8068c7c03f30ce14cef4b32a42903ac469753891d04bdf166ef169
SHA512160cc8468b152fcfc4a867a8f374acdcda776b5860264b760440c73aee17e54299b813bbe58fb22435fe45c8ebe2c80fd5e630c427650bce6713941e2bd4955c
-
Filesize
168KB
MD5ce34f6a7d9868f67bf36568df7b7b7a6
SHA1bded85f5c7190dc371552fa6d293179d5e7cedcb
SHA256e6c03b7ba0daef9c01e8ad38ba5d2c501169a4688e1833f5765077fe8f886b5c
SHA5128295566a0f162fd27fa2ccbb578ea095b07c4f8aeeb23da546240c7f335e9d3ccde585d94855dd7805f081a24efb6b24924217df194d52f9c61d70dd6fce8710
-
Filesize
168KB
MD5e4af7fbfb899ee94a2e58c870c0b8936
SHA11bd7982afbb2a47e353d990049fd2038f50ca08d
SHA25647381d2637731a18a8d407863dae01c8fccf342e858e9e26f495f5a77f37b064
SHA5123711e13f3f9d496b40ebc872010c532b2f31e23ae70fd77ded1c712bc63b715ad980a562628fa05e3a753d88828b689a11540a30a9043228d63767244dc5bc04
-
Filesize
168KB
MD533378e0062c4444ea869a54ff4013e59
SHA1248d59072670ab1b17e408032bf7e0c09db89688
SHA256bb7988da621577f2aac4e068037f2ef82c9a313714507f96cfea20d2d3622cd1
SHA512e8cb1c6e64f0cfa13248da72d9b9d1c03013284020467f535125ac05ccd757f51954c524cb31af98829815b9f8f1d121bc0b10c76e9a38e2dc93f0f5de0dbefa
-
Filesize
168KB
MD5e8308692e2234d9afcdf87d2c22df565
SHA13a9af6563d0e457ca71a7a443658b4802ed79530
SHA256f3ec195747534d277b5c0b6b4583ecf86b0c75c8b18b5d9882007423c0807caf
SHA512aab4a1fae38cc3767b52e4d13c7ad5f7d796a55aa2a40b7ee6249d59776d775946ce5f8fa0aeb442c9482f9ff78a7f9328e49617f946d0ba76c132b9703efd9f