kinsing | feddee5718f781bbf5913dd4fe8df6b1168651ad45eb08ba446600168ad0d8ea

General

Target

Little Witch Nobeta Early Access Plus 13 Trainer.exe
Size

1.3MB
MD5

3bc3f0fe207dbae4f4fe0a2e8c300a4e
SHA1

85759a013a1135bf452e47e9a282e683a7538993
SHA256

6a2780b68def659a958b7873ea3ebbb792119b5884b77a32d75f5fa2bb24192b
SHA512

3efd615c17721105d69ebbed352dbbe9857575ce2759eded0f4030e0b4e650054967927ea928687246937fb6c74f6b7ad16f0c87f5ccaa66621c6e94d97454bf
SSDEEP

24576:qSpS+y3KJdg/7pfEQaFQ+Rtf3yev8kC+4KFJqsCBh56FuksRDS:qTC/gj1Ta9Rtf3yekk7S5ouks

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Little Witch Nobeta Early Access Plus 13 Trainer.exe

pid	process
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe
3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Little Witch Nobeta Early Access Plus 13 Trainer.exe

description pid process

Token: SeDebugPrivilege 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe

description	pid	process
Token: SeDebugPrivilege	3100	Little Witch Nobeta Early Access Plus 13 Trainer.exe

C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-0-0x000001D8AB580000-0x000001D8AB5B2000-memory.dmp

Filesize
200KB

Download
memory/3100-1-0x00007FF91F580000-0x00007FF920041000-memory.dmp

Filesize
10.8MB

Download
memory/3100-2-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-3-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-4-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-5-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-6-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-16-0x00007FF91F580000-0x00007FF920041000-memory.dmp

Filesize
10.8MB

Download
memory/3100-17-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-18-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-19-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-20-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download
memory/3100-21-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads