Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:34
General
-
Target
2024-01-25_aaa58d116e01e3fd4ab9c1f65efa3583_goldeneye.exe
-
Size
408KB
-
MD5
aaa58d116e01e3fd4ab9c1f65efa3583
-
SHA1
88982993e1252c7c7680df51ef5c95d7bd3e4a6b
-
SHA256
01def3ddd9531a31c4a54f8eff1922693d558526dfc2aa8566a9f1a1f00a3b08
-
SHA512
0140d5acc9c3971e9bd82c8a70127d5c6cc8f9330e1e341a09d06e9f0e380db3a703dbc9cbdcd56bd0a97707f23be4e2984386829fbfea06ac1d0e4ee64cbf89
-
SSDEEP
3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGyldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_aaa58d116e01e3fd4ab9c1f65efa3583_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_aaa58d116e01e3fd4ab9c1f65efa3583_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8E8160F-8D63-437d-AD4B-016280A28788}.exeC:\Windows\{C8E8160F-8D63-437d-AD4B-016280A28788}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FFDDA8C-3B0D-4239-9D0F-DADA7C5198F4}.exeC:\Windows\{5FFDDA8C-3B0D-4239-9D0F-DADA7C5198F4}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96DC927A-52CA-4d43-8FC3-840DC7BAC3F0}.exeC:\Windows\{96DC927A-52CA-4d43-8FC3-840DC7BAC3F0}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9E68C2E-E84A-420a-87F5-2F9CF28290AE}.exeC:\Windows\{F9E68C2E-E84A-420a-87F5-2F9CF28290AE}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C3AD7A9-9CE3-49c3-B718-0ABC7AA1935F}.exeC:\Windows\{4C3AD7A9-9CE3-49c3-B718-0ABC7AA1935F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F413A30-20A2-4a2e-9D75-EA1E63E5BB4A}.exeC:\Windows\{9F413A30-20A2-4a2e-9D75-EA1E63E5BB4A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DA816B5-7283-46f6-AFC7-FEFF44C92026}.exeC:\Windows\{2DA816B5-7283-46f6-AFC7-FEFF44C92026}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C12B4554-14AA-4706-AF43-9DC5721224D0}.exeC:\Windows\{C12B4554-14AA-4706-AF43-9DC5721224D0}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3429A6FB-7908-47a8-9DC7-BACA293E50CF}.exeC:\Windows\{3429A6FB-7908-47a8-9DC7-BACA293E50CF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98D123DF-83CA-42ab-8728-222606583AD3}.exeC:\Windows\{98D123DF-83CA-42ab-8728-222606583AD3}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{231FFD69-401D-4136-BF85-2C1B6293664A}.exeC:\Windows\{231FFD69-401D-4136-BF85-2C1B6293664A}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FF7E98D1-E24E-4b0c-A090-B2C980175305}.exeC:\Windows\{FF7E98D1-E24E-4b0c-A090-B2C980175305}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{231FF~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98D12~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3429A~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C12B4~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DA81~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F413~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C3AD~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9E68~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96DC9~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FFDD~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8E81~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5761d01a7f45be78a547f4348625d1d20
SHA186be7a32ea609e9220d62e5fcfc877a6363d3c63
SHA2566572f0eed79d9e15979815a72bd3f898c73cc7fb10d9cfc1c0094aad98f2da02
SHA512254e41127cde03ae8a96c6b06ab3a370fb4b185c1484e517853d061cf8b179f9a581f296e1ddcadc9e8e82b5f88d38dcd4bb5f366683fa6561b3e82058ba34fa
-
Filesize
408KB
MD55db538efed4eac98e84548ba0ae008b7
SHA1881227fdcde305ba3ff002c7f31961dfaeb61a6c
SHA25616c08c03f7acef401b8116fed76b6b318b1cf4f74446bc49e36c23f5dbfa12e4
SHA51224960d4d15760e2556d3e1b8e9f32201ea0ab89eef30f2e930bac340e7e7f9b33879a206eb0fdf868fcce4a49bfa7cd7f1208a4075d44565f49f161e3265cbea
-
Filesize
408KB
MD5a9d8dae39e79629200a4af22b19587c4
SHA1a3690eb06dbd74215855c51a51a45a24991e8ebb
SHA25669a1c71ba72289fd6fe1f99cdd0b0b9428e1897ef3ff798924388fa68ddf28f7
SHA5128b8195ebe608a84a4b93a76dfd32de9aba8d8e61611125146667e2ea5e3d9e36d4478d815c96e5812d1278bb9ffb95663e10c7e2adc233e0327df7d774213cbd
-
Filesize
408KB
MD59fdf780718834f2614296b5ca35e13b1
SHA1308698376325ec1de949f969fa132f5a90ad4604
SHA256e22202c67912f30b10953080a0182010ede2d04f341e18310fce01139b9d43a2
SHA512e1401c6ea2e0191d6761fad9cb2244dba0f1d6bf013dcf29d77fd15340750626f17486ea2e98a256d7be5756ed917ee6797db0ecadc73efdeba1531c9aa7743a
-
Filesize
408KB
MD545ade2b9d22ce4257c95f8bfb118ac8d
SHA1af12b0e38897ee38d3a6955b23ba2ccd5908f527
SHA2565b4aea185cc2b0e83cae924c6c72127a2650c35daef54c70c0247c507d51329c
SHA512f715c08f9b1568da6b512a8ba86c675c4390dafeae6acc9b60530b59dbc7d0833b2f99cd107f1603064e48f8e4626420caf81d84126d9ea5c6461aa62d16e8ac
-
Filesize
408KB
MD51a6d6edda9430604f154ca885c0082e3
SHA15a360c4f017ace4205619319cc5fcbfdd17e909d
SHA25621789e15ca194c909c468abf654d2af2000fec7193063c4f707b63f129cdfbbd
SHA5120f8a80354c1849a075df715cba7cceea92d6490e76c012cd5b5069101e9f71452af8f634e5ba4503c19b65bb72f305fda577b72f5e6c7b022462022f8d2278e8
-
Filesize
408KB
MD5f48ec47ebca2e206c8488d4a8c71afbf
SHA1d6190910947454ec68bb6adefdb04b460c3fbc7e
SHA256659ad7d4a5c1d27bb4dd6f79e203551506a7ac2a45a01dd233cdbe64f77e95c9
SHA5120035b02962343a80ad8f5a22b5e313f7bcf22d206783139b7941095c7ca94c741bc57c824eef73169ad588213b2c7a802681a56fcdff3689915051d23e5857ce
-
Filesize
408KB
MD5393374028adf782ef3422f695b5eca67
SHA14fed01b4ead94546b459a9973c0abc6fbaf18982
SHA256df9ff4c425171f07e2113cca32a4c1e5cbde13cc92976d8a6416622a2935a1bb
SHA5124fd2b56208ad7756050642ede9d59ddf9496e39b4dd9eae509036d31fe8d722ba8e11e59502b81589726ef7b041851b6b85bc579f208487fe40390d6d91e8497
-
Filesize
408KB
MD5b280409c7dfadc28b07da0081467ca37
SHA19038eb560f9494683fb1a9dcb8ba679f0c1e3d1c
SHA25617edcb615cce6411eb1d89b70072ae71fb51c90be03de1b868d6c5b883e107ca
SHA512e258bc67d5c4a75d0cd0d01ff6b35ce487504346392c3662284f14851732eb5b2d435eaac4859ac12bfec0093f618691d1b19520b8e19d72b74e28f6aadbc355
-
Filesize
408KB
MD53aab1228a1511b6cef7abdbea8a5193a
SHA185cd022db16682f57381d5e7a710a69e52b78c72
SHA256169692ec48534761ccdeaa31573e702e6e4f11f623875a4cb2aeda7b412c166f
SHA51207b5447181274d48bcb238147a5b8ae18ff9243da5a1cf0ba693725a5b9bbae4236443645cebb2e17ed85a16da2525689b931f5ece95b723d113e1afdb9c773e
-
Filesize
408KB
MD50e37a9bdda175233f48c26d3c3bbbd09
SHA1cf72e7c55e19bf0e946710ee98f2c1a25d1bfc16
SHA256680aa489438e1932039bd79dc9dbe8ae97b303013dad3a91faf8215eacf8ac28
SHA51249003f9742b8c2277c4b59735e3478b6f6c8564d713accbc3b69a8caa063b57154d06211ff84742cb310933bbf5152bedf8fd2cb762f36c6f1b7e9fbfd65219d
-
Filesize
408KB
MD537fd390ad7b985a2d5ff61c870ede3c6
SHA1699f96d54ab066280c5ab60b86f29daba0f04d72
SHA256c5195e7d2843fdbae0253bc2c1e5a3450b81a6ca226bc4d62fb6d9d555959e1b
SHA512bb47f533aff21ecc01193ee232210339767c9364353eae2e496fddc2e9da5eb72305ad30fc288cd5f4448c8ec06261efc85c0933c2ac8e234ca4dd198622b8c0