kinsing | c0af1d3171fc09a50db774c84d85ab5197a7f770372d2d93e4c54313816f0b7e

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:31

Target
751a48a12078e2c512af6014a53b630f.exe
Size 176KB
Sample240125-v33shscfaq
SHA256 c0af1d3171fc09a50db774c84d85ab5197a7f770372d2d93e4c54313816f0b7e
MD5 751a48a12078e2c512af6014a53b630f
SHA1 cb8e204bc8c7bfa8cb03881ce2acc124f543ca61
SHA512 18f2e2764950fe4e79d7a02f2aa8582dc3a7dc5eecf86ea391012c121d00e2f0b805383aadf9dcb1c3e5c68f6a1be26d3c92a784e7bfdcb827c12612b69d68c5
SSDEEP 768:lDSxf89x8dLQc9CcXdUT0VrvGoCxloLsyc9pOT0MhH9as0D91iWeTT:lqY8dLQ3loQX79MWrD91T0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2828 set thread context of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	751a48a12078e2c512af6014a53b630f.exe
3668	751a48a12078e2c512af6014a53b630f.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88
PID 2828 wrote to memory of 3668	2828	751a48a12078e2c512af6014a53b630f.exe	88

C:\Users\Admin\AppData\Local\Temp\751a48a12078e2c512af6014a53b630f.exe
"C:\Users\Admin\AppData\Local\Temp\751a48a12078e2c512af6014a53b630f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\751a48a12078e2c512af6014a53b630f.EXE
  "C:\Users\Admin\AppData\Local\Temp\751a48a12078e2c512af6014a53b630f.EXE"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3668

memory/3668-2-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/3668-7-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/3668-4-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/3668-8-0x0000000000400000-0x0000000000406000-memory.dmp

Download