Analysis
- max time kernel
141s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 17:33
General
- Target 751adf5ecbf0e57c3870b117201bd97a.exe
- Size 691KB
- Sample240125-v428dacfep
- SHA256 4678f587420c2e5b0d36545f84c0add26c99ff80c40e611d1c89143e30cae215
Malware Config
Signatures
- Kinsing
Kinsing is a loader written in Golang.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\751adf5ecbf0e57c3870b117201bd97a.exe"C:\Users\Admin\AppData\Local\Temp\751adf5ecbf0e57c3870b117201bd97a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Hacker.com.cn.exeC:\Windows\Hacker.com.cn.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1.exe
1.exe
Hacker.com.cn.exe
Hacker.com.cn.exe
memory/436-31-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/436-25-0x0000000002280000-0x0000000002281000-memory.dmp
memory/1624-34-0x0000000000630000-0x0000000000631000-memory.dmp
memory/1624-30-0x0000000000630000-0x0000000000631000-memory.dmp
memory/4000-17-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/4000-10-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/4000-19-0x0000000003210000-0x0000000003211000-memory.dmp
memory/4000-0-0x0000000001000000-0x00000000010BD000-memory.dmp
memory/4000-15-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/4000-18-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/4000-6-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/4000-14-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/4000-13-0x0000000003180000-0x0000000003183000-memory.dmp
memory/4000-12-0x0000000003190000-0x0000000003191000-memory.dmp
memory/4000-11-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/4000-16-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/4000-9-0x0000000000D20000-0x0000000000D21000-memory.dmp
memory/4000-8-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/4000-7-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/4000-3-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/4000-4-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
memory/4000-5-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4000-33-0x0000000000AC0000-0x0000000000B14000-memory.dmp
memory/4000-32-0x0000000001000000-0x00000000010BD000-memory.dmp
memory/4000-1-0x0000000001000000-0x00000000010BD000-memory.dmp
memory/4000-2-0x0000000000AC0000-0x0000000000B14000-memory.dmp