Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:30
General
-
Target
2024-01-25_780d9a0366a953f6b74dd4bf20da23dd_goldeneye.exe
-
Size
180KB
-
MD5
780d9a0366a953f6b74dd4bf20da23dd
-
SHA1
88f263a7d696826dbc147af8cff02fa1ae2a8ebd
-
SHA256
a4b5a5eb9a43ca8ef3f64d5f4c6722d14107628125b90ccc83bc850a4f1472eb
-
SHA512
2cfc16a835645d70b9b1b3cca7c50b9539aa6ecdc9b009c2846ccd6dac05336cbf93bfe9718977147f9f17355ea5efdd80625709f2a8ed2048b1ca56f76a45f1
-
SSDEEP
3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGtl5eKcAEc
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_780d9a0366a953f6b74dd4bf20da23dd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_780d9a0366a953f6b74dd4bf20da23dd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0ADF6303-752C-45b4-B0A2-6A7BBBD9AFB6}.exeC:\Windows\{0ADF6303-752C-45b4-B0A2-6A7BBBD9AFB6}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A746AAA-69D1-4f91-98A0-22315DD66CD5}.exeC:\Windows\{4A746AAA-69D1-4f91-98A0-22315DD66CD5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AB6674E-1A4B-49e7-8889-81FA51EF3547}.exeC:\Windows\{9AB6674E-1A4B-49e7-8889-81FA51EF3547}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5DC8091-40DC-42fd-87B0-35DEB241BF3A}.exeC:\Windows\{A5DC8091-40DC-42fd-87B0-35DEB241BF3A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53153B56-D753-4421-8739-15BAEB870646}.exeC:\Windows\{53153B56-D753-4421-8739-15BAEB870646}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53153~1.EXE > nul7⤵
-
-
C:\Windows\{0E6340BA-E0DD-4634-868B-E0F04C5F4811}.exeC:\Windows\{0E6340BA-E0DD-4634-868B-E0F04C5F4811}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D126CF0A-11B4-4f23-82A8-ED2098173B65}.exeC:\Windows\{D126CF0A-11B4-4f23-82A8-ED2098173B65}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
-
C:\Windows\{401F2BFE-C57C-4bc0-A195-A0E9C08C5DC9}.exeC:\Windows\{401F2BFE-C57C-4bc0-A195-A0E9C08C5DC9}.exe9⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6651A27-A165-496e-8BDF-BE307D743198}.exeC:\Windows\{D6651A27-A165-496e-8BDF-BE307D743198}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E987E6A-CF8F-46e9-93E5-722018C3141F}.exeC:\Windows\{1E987E6A-CF8F-46e9-93E5-722018C3141F}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF3CB4C0-16F4-4415-A17D-2D2465AFC008}.exeC:\Windows\{FF3CB4C0-16F4-4415-A17D-2D2465AFC008}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD5DD6E6-D168-4513-8562-F2F2B0BAED28}.exeC:\Windows\{BD5DD6E6-D168-4513-8562-F2F2B0BAED28}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF3CB~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E987~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6651~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{401F2~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D126C~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E634~1.EXE > nul8⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5DC8~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AB66~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A746~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0ADF6~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5f678cddf61b5d922ae65f663199176bd
SHA1cc0ccb497e08fc76d4ea4aa193b2c7d24ecad58d
SHA2564d637169e303e6a3ac5055fa47867a68745a6226737fb079a3a6403754ae982f
SHA512579b90cfbd153efb43b372851159a55a5bf1b4fce0c937427da3321035ea207a1d45ea1da594a79be03fe0e201d36262f4894f1bfc60c90feb2ee2a928475b17
-
Filesize
41KB
MD5d4bda7edafbd01419437cef844e2852c
SHA157819e68a9c0fedfe25f371243fd15d751d52760
SHA256bb32f19790a3efce7b102df55d150cf28e5056eed31148cf89cf39c392c81c0d
SHA51236e8134d149c433e07fe293b15cafc6dfb1889738106bae7818b382d87fdc14c1a82971bdd0a2e6420fbf870bcd9390cb4b81d990b59d7dd400e6714510dec06
-
Filesize
180KB
MD5198d2be0288289b928f7909c1675bda5
SHA18b165dade9b5c05309a7eb0cc23809dc3b747753
SHA256ce8c89fb03ee6aa309ccdb8027e180b718149e1e6725bab75e0059a30cba5b49
SHA51288cc2c988624969681e24a7f87c1491a66a46391909be35308dade89e79cfb4ad27facd7a20b6ebe7d0c3e4bb77886a513366020bbc0d392d13df8f01ec11163
-
Filesize
180KB
MD5c6c8a624bd45f5a458ffd2110c3840db
SHA1042dca52017d8bfbc982ea673f34323c7b200aac
SHA2561252f3399f4b70eda988d4b69b1b19e82377d0b1dee999477f71b23a0e9e12ac
SHA5120d339093ab48a6c8a86cf2b461c0580a119aaba9ab6c354c94a9a10675911bbae6dbeebbf18a9b0fc9b9c3b858fcb336d8c88efc07ce94cc8d41015f1c19fa1e
-
Filesize
180KB
MD53aa16f86141251b11d33960409a6cddf
SHA196994d860eb5f0054d0fa9e566b1224ae45a5b60
SHA2569c36baa66fa673c283861afc95107220d5551ff36e88a26ba82b8953a970d8cf
SHA512a40f24ab51ee4c363d200f33e50510220be04056db6a191a05387e450c46e8aec8929d5636131c5a74213b800cd7000eb91251e38b1a8487a7fce681bddf0e03
-
Filesize
180KB
MD55e0613ca3a8f79de402e91fc1d904ca2
SHA12ecadd7d9f1d705bcfc4cdd20a661d602185b8d2
SHA2561773b98718c44271b5ddc750c377b8953c8b5ebf531c7dff7a60a985e74b3058
SHA512317f719060da610ac4d24c274a6804ed405c2a31b6496a2476cbd00789d79ccef144734818c4add39e96d5dbc3c1c55ed68d874c27fe1e6e64216afdccf08c6a
-
Filesize
180KB
MD5e95d1fb3066f9d5e04cfa23f3c7cfc68
SHA166e5ffdb9ee41fb6bfba65cd55e185ddda4acd23
SHA256244b7ce0409980a550b67ced422ceacbfb627a69ae6aa6000e442ad67b1bb515
SHA5128aa696bb98caa63b80e7676609a179fbee9909acb8abd386c2ad53fbba5e4e00bcc1d7e8dff124ddbc29ae801df3a014d27aa5da5cc2e655adf87c5a92753cc8
-
Filesize
180KB
MD5eaf585e50d53d980861cc4a9f45067db
SHA1632a251c967637b6473e93f4071b13160e669124
SHA25687cb2b9b038b15eb9b4d7dabfa92d348091cfb5dd731b8b83ac735b286674b65
SHA51298317b5e0715365d928c86779d6dac312c2a9752b5615d8755407e403e99e523aeb8be48ebd6027cbbae5c8a9d4521b6925ac25588b31a2518d823f3eb4f4317
-
Filesize
180KB
MD5f8196f5c9699c6346747cb591b5b520d
SHA12218559e05f8f42d31931f29d454793d4375030b
SHA256180b383cd7c71a5345d53b2d095f93fee16e410b041ec35dd6d240be580bbb81
SHA5126aa1c1baa574c69d0fba734f3917ae4f8924c1ddc8f589699d06bfaf5c3a2ace5d14f2726b7c5a6074dd60dbb10dfb6b9127fb2da0eb4f9b49342527623a0da3
-
Filesize
180KB
MD5bf41414306e8f450ebdd1a60759e4467
SHA17bd83c21a2cc18543f57c2efe1887e12e8ea2bf7
SHA25666bbac44e68ff97f3707628dd7ab4d73409061e18413d7a3502e7d9dd024996c
SHA5126eaac411e631fa7b35767ad0a074a4acf04f04c3033f56d8c89e89c4973ac7cbcbcb9cd5a82f0f1ddbf581b3a4244d6b4d65cb61a4f9eaad47a1149c12c43bcf
-
Filesize
180KB
MD587eb4086624ef88a5d8466d5cff623a7
SHA16c41c34a0e6461d40fb766d588bdb7a0fe16c774
SHA25656b66649e80ac6686bd1757aab63626fee3208c8856448fe60f3cec224982463
SHA5129b171c23a986f8121e244c90946bce32e10f2a2bc8fa02041a98b29729c125cf88926ebd58bc3439961b1fa495ba7b2761bcc2429e116c29c4f6bf012d538002
-
Filesize
180KB
MD529e897c45d90738cfe6023c59adfda11
SHA1c216f033d07870a738a5d349a1047e420eb572ad
SHA2564b5f99c84bd60d4e479a02576e6e94059d3310be1710fa12da65522fc6ed9efd
SHA51211612f59db2e6e4f6038938027f5fd8c94282c6b3c32eab622a78edf8fee7fa6cb56ab864088f5822804ba0552b0a98df2c992efc1945301918411956223ccbb