kinsing | ca256ecb0e7ff2121f9349e15f220b5849e4baafc89b9aef11ca9d80514abcf7

Analysis

max time kernel
156s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe
Size

49KB
MD5

9b3f32a285f0924d1dfa7a5fa4a70034
SHA1

8f07927f84b2d97cee94099f339a42261c63f840
SHA256

ca256ecb0e7ff2121f9349e15f220b5849e4baafc89b9aef11ca9d80514abcf7
SHA512

74d60c199864e06be8cc5e7ea59305dfdc1142d4af92cb09d68514873fe85805ea496d0a72ccca9ffcb7be70278e1595282fb38148216be105af03ab465280d7
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQ7suIlsw92KFXpQenhux:V6QFElP6n+gMQMOtEvwDpjeJQ7pojkRx

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023200-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023200-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid	Process
2104	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe

description	pid	Process	procid_target
PID 2700 wrote to memory of 2104	2700	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	87
PID 2700 wrote to memory of 2104	2700	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	87
PID 2700 wrote to memory of 2104	2700	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
199a2cab08ddec8a7f943b5a0d5dfca8

SHA1
9902bd373aaef838d9070452f135aedfae6b394c

SHA256
586d31370cefc2d9778f9c99268dbd29df059b3e1c33b68f36d3dc45821a6c36

SHA512
93b3dfa7478f46c2d00aa5c2fc5ee7b511d37c40b4ae863b547c0954251ab093be7c414a128ab3017ab46a171fc2a75daff11bafadf54f271a30fb75c05694ba

Download Submit
memory/2104-17-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/2104-19-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2700-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2700-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2700-2-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download