kinsing | e6d3aed6a3736cae8fc9dcf0840027917dadd03af9d53c32b0e3db7c023b9871

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe
Size

46KB
MD5

9b5c4613dc241dfa68ecfa73cc7cf1d3
SHA1

451cdcdf6cc49c744aca1e9ec85838fe08ec606f
SHA256

e6d3aed6a3736cae8fc9dcf0840027917dadd03af9d53c32b0e3db7c023b9871
SHA512

399f1db43a91e46d878c1cb3b8586ec55d6b4a4eeadfeae6680c57070c147a092ee85c1568a32a40380b5c5c2cc9226b5d3f47efd0ca79223909f30c764e69d8
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hDJ:bgGYcA/53GAA6y37nbN

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

3312 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3312	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe

description	pid	process	target process
PID 4712 wrote to memory of 3312	4712	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe
PID 4712 wrote to memory of 3312	4712	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe
PID 4712 wrote to memory of 3312	4712	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
46KB

MD5
585ecf172e8b9efac582e4732d0911da

SHA1
b3db62eecb985b0af6e5250dbf8e0d61e8e1cfdb

SHA256
760459c5a2a4f7ec497e6cfda15136d811a66104672690fd0d67f346dcbed6cf

SHA512
1fd88708884dff26982516c608555f316d8ec47320e00905e8a1b2b7458b62c679b1f334601aec5f256ba05dcc7fca03c75921fa23811047b911ff1386a938bc

Download Submit
memory/3312-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/3312-23-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/4712-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4712-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4712-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download