Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:35

General

  • Target

    751bb7e94eea53e73da0c642939b37da.exe

  • Size

    385KB

  • MD5

    751bb7e94eea53e73da0c642939b37da

  • SHA1

    33dd32d353940f2b3998d439ccbd4f8dc29a4745

  • SHA256

    816ceac49c2d646e60cdb2dc54c860d9f8352c099eef6b9aad6521613348ad5f

  • SHA512

    565650cb842c3166861229c31cb1c992d5b31e35ab1e102758ebe6d14df53ccc3ea9ecd1c2d82440900deaa4190060317e8687c15fdf094869b1c0f34fc37ad5

  • SSDEEP

    12288:F0Jl/Ct2wbPCSl4csZB9FnA0I+gqMFK6O2S8B:CLCER24x79FnAF+5MU6Or8B

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\751bb7e94eea53e73da0c642939b37da.exe
    "C:\Users\Admin\AppData\Local\Temp\751bb7e94eea53e73da0c642939b37da.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\751bb7e94eea53e73da0c642939b37da.exe
      C:\Users\Admin\AppData\Local\Temp\751bb7e94eea53e73da0c642939b37da.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\751bb7e94eea53e73da0c642939b37da.exe

    Filesize

    385KB

    MD5

    4bd4cc6cdfceb75845e0a22399fadad6

    SHA1

    eb62571ef88e71447251d412a39f59c2691bbdc5

    SHA256

    38caa3db5f0d87736d1ae188c7b3f0ce49b8acb8bb5e33ae4a44ed9f026bf576

    SHA512

    0ea795c32213a8fea7d0807b67ed6acb28e7707fa93c483e22598c6a8843d6e0f758a6b61d3ee42fd711f386163f7eecf07f8bd4b00eca0539793aac3537190a

  • memory/3456-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/3456-1-0x0000000001470000-0x00000000014D6000-memory.dmp

    Filesize

    408KB

  • memory/3456-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3456-11-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3912-13-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/3912-14-0x00000000014D0000-0x0000000001536000-memory.dmp

    Filesize

    408KB

  • memory/3912-20-0x0000000004EA0000-0x0000000004EFF000-memory.dmp

    Filesize

    380KB

  • memory/3912-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3912-32-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3912-37-0x000000000C620000-0x000000000C65C000-memory.dmp

    Filesize

    240KB

  • memory/3912-38-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB