kinsing | db73c09915436c502a4606a64069bca90c7ed293c45c94990ed0ee1b1bde5cdf | Triage

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:32

Sharing

Report Analysis Logs

General

Target

751a9c126ce0eae29f5892c6a6a7e17b.exe
Size

317KB
MD5

751a9c126ce0eae29f5892c6a6a7e17b
SHA1

b5cb5ff516228e956f2d04616242528ba9b17faa
SHA256

db73c09915436c502a4606a64069bca90c7ed293c45c94990ed0ee1b1bde5cdf
SHA512

1aa5851c46652a8b36c75b5f877cf6498d5b67f92506029acb4b0d9cee170e5a2d48e5304459e1c98693ce38361d20ed0d18f86e7a93c714e05c344ec15fa35a
SSDEEP

6144:4moeWIEK/hSdSu2OwfW91O5fW98sDr3rK:X7IS+ZP8sDru

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3100 1504 WerFault.exe 751a9c126ce0eae29f5892c6a6a7e17b.exe

C:\Users\Admin\AppData\Local\Temp\751a9c126ce0eae29f5892c6a6a7e17b.exe
"C:\Users\Admin\AppData\Local\Temp\751a9c126ce0eae29f5892c6a6a7e17b.exe"
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 512
2⤵
- Program crash
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1504 -ip 1504
1⤵
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1504-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download