Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:32
General
-
Target
tmp.exe
-
Size
301KB
-
MD5
d7e07baf23641fa08a4067ca07ea4b4d
-
SHA1
eda4e790cde8b30cb46558b94415e4a916f56e78
-
SHA256
c7cbef34bbc2ae01c9131646954a2fec8ab6f7cbd70ee2d92eada6796884e1b8
-
SHA512
ffc65c88345d482bbfe100f8ca804b4470dedab81c580873e5134872d41aa74c9bb11c3978165b0f62e275b2c95f2c158f02222d02e64f7e794bc157699f89a5
-
SSDEEP
6144:HhjGvEehzo1urn+utlHJ3hfcAOqGJF/p/uwONct43j92UysA:H12Eehzo1uDkf9pGHNu4B2UW
Score
10/10
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
516KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
200KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
224KB