Malware Analysis Report

2024-10-23 21:11

Sample ID 240125-v35l4sbga8
Target 751a543074b122a6e9ccc2bbeb7a821f
SHA256 feddee5718f781bbf5913dd4fe8df6b1168651ad45eb08ba446600168ad0d8ea
Tags
kinsing loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

feddee5718f781bbf5913dd4fe8df6b1168651ad45eb08ba446600168ad0d8ea

Threat Level: Known bad

The file 751a543074b122a6e9ccc2bbeb7a821f was found to be: Known bad.

Malicious Activity Summary

kinsing loader

Kinsing

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-01-25 17:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-01-25 17:31

Reported

2024-01-25 17:34

Platform

win10v2004-20231215-en

Max time kernel

143s

Max time network

151s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网最新单机游戏.url

Signatures

Kinsing

loader kinsing

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网最新单机游戏.url

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
GB 96.16.110.41:443 tcp
SE 192.229.221.95:80 tcp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-01-25 17:31

Reported

2024-01-25 17:34

Platform

win7-20231215-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网热门MOD补丁.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网热门MOD补丁.url

Network

N/A

Files

memory/2672-0-0x0000000000430000-0x0000000000431000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-01-25 17:31

Reported

2024-01-25 17:34

Platform

win10v2004-20231215-en

Max time kernel

134s

Max time network

149s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网热门MOD补丁.url

Signatures

Kinsing

loader kinsing

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网热门MOD补丁.url

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 137.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-25 17:31

Reported

2024-01-25 17:34

Platform

win7-20231129-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe

"C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1868 -s 840

Network

N/A

Files

memory/1868-0-0x0000000000340000-0x0000000000372000-memory.dmp

memory/1868-1-0x0000000000340000-0x0000000000372000-memory.dmp

memory/1868-2-0x000007FEF63C0000-0x000007FEF6DAC000-memory.dmp

memory/1868-3-0x000000001AF90000-0x000000001B010000-memory.dmp

memory/1868-4-0x000000001AF90000-0x000000001B010000-memory.dmp

memory/1868-5-0x000000001AF90000-0x000000001B010000-memory.dmp

memory/1868-9-0x000000001AF90000-0x000000001B010000-memory.dmp

memory/1868-10-0x000007FEF63C0000-0x000007FEF6DAC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-25 17:31

Reported

2024-01-25 17:34

Platform

win10v2004-20231222-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe"

Signatures

Kinsing

loader kinsing

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe

"C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 flingtrainer.com udp
US 188.114.96.2:443 flingtrainer.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 173.222.13.40:80 x2.c.lencr.org tcp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 40.13.222.173.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/3100-0-0x000001D8AB580000-0x000001D8AB5B2000-memory.dmp

memory/3100-1-0x00007FF91F580000-0x00007FF920041000-memory.dmp

memory/3100-2-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-3-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-4-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-5-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-6-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-16-0x00007FF91F580000-0x00007FF920041000-memory.dmp

memory/3100-17-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-18-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-19-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-20-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

memory/3100-21-0x000001D8C3C60000-0x000001D8C3C70000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-01-25 17:31

Reported

2024-01-25 17:34

Platform

win7-20231215-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网最新单机游戏.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\游侠网最新单机游戏.url

Network

N/A

Files

memory/1984-0-0x0000000000230000-0x0000000000231000-memory.dmp