Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:32
General
-
Target
2024-01-25_8d15983b44ca410b26bcb1edb2e588f3_goldeneye.exe
-
Size
180KB
-
MD5
8d15983b44ca410b26bcb1edb2e588f3
-
SHA1
c918100f2164d5e25cc71b4bc742a01b64e836f7
-
SHA256
6b93f59a8cd2eddc51651cbcf7bf7d6386a910beb7bd4bdc93be6ad8c3714bd8
-
SHA512
d34a0263343aca76e4f9f995f0d25d6bd67ef1bf2762f4315c57587ae63733b9fcc4e8dff89c914a598a93356aa995cff3bb98fee2158ef99d326a45777fdf7e
-
SSDEEP
3072:jEGh0o/lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGll5eKcAEc
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d15983b44ca410b26bcb1edb2e588f3_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d15983b44ca410b26bcb1edb2e588f3_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11A9AFA7-D17D-4b0f-AD79-9542A28D67DC}.exeC:\Windows\{11A9AFA7-D17D-4b0f-AD79-9542A28D67DC}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0B47F50-1626-4d53-80AD-55E42391FB38}.exeC:\Windows\{D0B47F50-1626-4d53-80AD-55E42391FB38}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E25E36E-9AEC-490b-9BAD-49937DD15DDC}.exeC:\Windows\{6E25E36E-9AEC-490b-9BAD-49937DD15DDC}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{502ECEF9-5EB2-4c38-96D6-43E00D08DE8B}.exeC:\Windows\{502ECEF9-5EB2-4c38-96D6-43E00D08DE8B}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C774A946-17D0-4364-90C2-FACE823EBCB3}.exeC:\Windows\{C774A946-17D0-4364-90C2-FACE823EBCB3}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24830048-D45D-421e-9010-6ADD79E6B8EB}.exeC:\Windows\{24830048-D45D-421e-9010-6ADD79E6B8EB}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F519155-F399-417b-B0CB-86DCEE4B6588}.exeC:\Windows\{7F519155-F399-417b-B0CB-86DCEE4B6588}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67237A6B-13D8-494a-9694-7E3D78BF0B54}.exeC:\Windows\{67237A6B-13D8-494a-9694-7E3D78BF0B54}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85270AF2-D633-4cc9-B0BE-41D68AB99CB8}.exeC:\Windows\{85270AF2-D633-4cc9-B0BE-41D68AB99CB8}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{221E345D-F0BA-4b7e-BA82-94C25018B861}.exeC:\Windows\{221E345D-F0BA-4b7e-BA82-94C25018B861}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55DAD4F0-1C5F-4c14-8ACF-FA95FD1DA1BC}.exeC:\Windows\{55DAD4F0-1C5F-4c14-8ACF-FA95FD1DA1BC}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D8E3C3E5-340F-4a6f-A138-6E0B99C57047}.exeC:\Windows\{D8E3C3E5-340F-4a6f-A138-6E0B99C57047}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55DAD~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{221E3~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85270~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67237~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F519~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24830~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C774A~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{502EC~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E25E~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0B47~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11A9A~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD569024dc6ec2573df3219cafbf694d45e
SHA1d953e80a307368608f610effaca983deb6907eba
SHA2563bd99d472ea28ac8891bfa42383532f8bffb35d1892ee0c1128bf8cffd6b5b83
SHA5128154e7181d11ec2c4cb5d25317a1829cff67e15931bb52c7fd8923aeafc733c6ecc5a7d9b2ab39310b63e5e082ad3a980610a4ee9d67c1024bdde510b23e9dae
-
Filesize
180KB
MD5e65d19488abc72f5b726c53e0d81d759
SHA1ca6972af1e4dc928ed39b6ebd41a3b4c8e87a260
SHA256ce75f0d04811a919c62802b16e2250a86743dc5307de84155557273548e85d25
SHA5123cc713fbe26298f17b7fe791eed1c2791100f13193c52140e04562605a865e7f9e6993c52dda833597876ce8e15c3073a2df4ec244e9abe60a4ff12e730084ab
-
Filesize
180KB
MD50ae64d694da20642c4e5893d654b42a7
SHA1c21c75a1363d62897b0cc31331600b674db2f0a8
SHA2566753ec0a8c2842fb0a150ed5d7b2febe4d0372d4d906167632690ac4ca928386
SHA5124d3cef5a0d4ae022093f7ac8479564f13c81a37178a51035c78bbc812a225957d6ded2d17fa54a80184efbb7240c9447d1e1670e6b7d317c850e6c9302e32cc1
-
Filesize
180KB
MD53a6dce5fa139d229a1f5f9b51717d2a0
SHA1691c833d12e16d7d45357879148d93203eac8289
SHA256f5439e0234a8d7893847592d4316125fe0e8e22fcec829234aa8d072b3eb3ea6
SHA512b93d3ffd98f05ef20be55da35d7084a5f745c9f44e929465ec9e9fbc6dc16ea5ffe28d5c88f3113ee9b1a4cb659bb159106bf17677ab02640070c5b5bf3ae9e1
-
Filesize
180KB
MD5d77a05685576ee077b35b9a1ea1d790f
SHA14a2455e05286222b73a9dc9d60066559877f54df
SHA2565bf66d84220e665ac7c2750ec34f04930f436a6422ba953ada25613c8e9098e2
SHA5123246cdf4c6e5d90465f79c628d239b57dde6ba85db04e780056b12067141ca5d2ff6ad4a19b9b900b75dcc321a335f84d34444c92f338bc71fdf8bc71bba99f0
-
Filesize
180KB
MD54c4c867ce4a184c7a0e449829b2f7ea5
SHA18183bb3f8da523988acc3133a29856fb9829402a
SHA256173b68790b31496802eef9133d0722a3042768985306b7ad2ad253b59f23739f
SHA5129a921687012166fe68502888b08300a415178534d317c5d0e50174f41abe057f149507d936946014034bc3a6649a4b6da9aeb5a29b1b0d576d8148961f166c5b
-
Filesize
180KB
MD530710f9540ff9c5b1db57bc365bc5ea3
SHA18d6059b3edf46708686e37fd588cda8d3c897dc2
SHA256c8a8c9d6af55e36ec44542c781a83b7e65219908661b6f61c0d2c837cde8782d
SHA5129c23c489e1b2bfbf67f2bb4b2ea278d6fa823aee90d55de6fb93d79a2ccf868a6450e5dc906ef573a37379c8b75ee63318ef466d54746660217a50e42d5c0364
-
Filesize
180KB
MD59e6299e759a5d92a5fe00f5b7341f6c7
SHA1e3605512ed72e5dc96f55bf0f22aca0c1f0e144c
SHA2565eadfb3613cc15a56f3f5dc13f5f688954541983933d171665adc40f872fed29
SHA51209d6259ef039fe6ece5ef16a19eb9488a69b40d338db3dd8acf9f3bd445cce0fe7c58d90dd5e6c7b6ffc5163dd5172f5ccc3c999b22dc897d0a89aa4a7add63c
-
Filesize
180KB
MD54bff1603dcd89edbc0d812c4296ae809
SHA109f421d7d0c5b499c231460b0e909025b056056a
SHA25628a853069b86ebdb6ddd759fca342fb2c01264ca33b852c8719e6f411d3b1284
SHA5122d06faec0f841142e2af7100001fd4334dd81a2dcf05d591062fc4a7efd587ee84e3fa199b97577aead6ba438fe1a6134dc2ea63fc0b8d3539701cc67c5f8f9d
-
Filesize
180KB
MD549ace39d602160f4e3f8c5b3bb0922b0
SHA183cfbfab882d317b386bb1260f6cce9517213caf
SHA256db3fe6113991cea4b4456bcb647f308d41cbd6381a03879d476f7ee09c1f5842
SHA512c50e5cb1bd8cefb45b8351ba462aebe881f8b3f5f581a01dd2c0237f3def85920e05e4e46bb016450e9daac6e831c2f38a100c76f57e62b632837485cb444f5a
-
Filesize
180KB
MD57eb1c02bb3eddbbedeb86f5b060af21c
SHA172490a782c8ae5a26e315fbb1a8168fef638e724
SHA256c4b54bd03b5701d71e7aa122202fad75ecb2f014d905c165adf3f3b7060d0c22
SHA5120266b4c6a723c1d808903cada3c53cf83fbbd3dbb9f44c1fce0f89a5365f523fb3cd3895ac3c8239a742670c673c2a3c8fa5c536610308425ff74227c8995a30
-
Filesize
180KB
MD585b3a951a3a110a9a8f1219ac9ccc26d
SHA11960de13df25cf2f89c89be5c67ae975573581e5
SHA2565e6ac7553986dd14f472078c91faa8d829dce2dcccd6955415ee7b5a7beb4450
SHA5126993bb31bd54d94fa5ba7ae4a7681d74da6657543633416d039bb4837113389ad6a32cba9b1958eb7fe73384d70afc708db6e00187c019cc02b74f62c9b4ee6a