kinsing | 4e4c6574601cccdee96ee946fb4f8c2e5f35280ea7888dff7c9e96908790d59a

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe
Size

47KB
MD5

aa207dd2cd8212d7f36bfae60463c24c
SHA1

adbabfc97a8abb04708fc19faeff096f173b48ca
SHA256

4e4c6574601cccdee96ee946fb4f8c2e5f35280ea7888dff7c9e96908790d59a
SHA512

3a9c94d8461ad8d30e50027665583fcb4ecbb9d636385c00f95136de3abd48dacff03aa91ebd44a614e94359f662d67815c29de0d7ff33be69f7993eefd40273
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rzhwa6E:xj+VGMOtEvwDpjy+Tr

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/912-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral2/memory/912-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2984-56-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/912-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral2/memory/912-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2984-56-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/912-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/912-25-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2984-56-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2984 misid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2984	misid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe

description	pid	process	target process
PID 912 wrote to memory of 2984	912	2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe	misid.exe
PID 912 wrote to memory of 2984	912	2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe	misid.exe
PID 912 wrote to memory of 2984	912	2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_aa207dd2cd8212d7f36bfae60463c24c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
20e1e01db030fe15093bb42ebd10ed93

SHA1
f7ae079e1a885d3b9e277507efd7d4848e298b84

SHA256
aea75986ec5b451b1e6fbd17fded2f96a6ce416d75f7d04c7d0e227b592c08da

SHA512
09552cddfe92e83568c8ee69c5fa61e32959ecee061c40bb784e62f6c18e94d8b38c52c1f36509cb1ec0f5f6b2510dfa75667cab501cee38dc65fda5ce52c42f

Download Submit
memory/912-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/912-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/912-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/912-3-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/912-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2984-18-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/2984-24-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/2984-56-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download