Analysis
-
max time kernel
110s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:30
General
-
Target
7518f584e1731ba3df2a3c743d5e1bae.exe
-
Size
8KB
-
MD5
7518f584e1731ba3df2a3c743d5e1bae
-
SHA1
aa519cc1e0daa9559797f9e0d7e1c5a4b6313d3e
-
SHA256
46b5c6cb45a40435525accc5a1c769207a7586860741bd434d5cba8bc1639aa1
-
SHA512
54c3e1b1ae9768fb6ba5d534ffb45ceb1071a6a0eddf10b5c0d38fa0101c15f8627b57a126ff9c7d7f4f00c84efbb62db5016b84694e8532b7c3fa41f2ea10dc
-
SSDEEP
96:eTMO+PNrOhw8etUiVduw6uQ7zxxpP6FMl/xCZFRrhebvgxE9fETmnJjMxuvI1vg5:s+1rOG8I/6fXdPJl/onzkHlJGuAq4du
Score
10/10
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7518f584e1731ba3df2a3c743d5e1bae.exe"C:\Users\Admin\AppData\Local\Temp\7518f584e1731ba3df2a3c743d5e1bae.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\SIGNUP\conime.exe"C:\Program Files\Internet Explorer\SIGNUP\conime.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB