Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:35
General
-
Target
2024-01-25_add0c32186c6990912bc0fe959b309cd_goldeneye.exe
-
Size
180KB
-
MD5
add0c32186c6990912bc0fe959b309cd
-
SHA1
54b5d13a34914aefeee12ad82ff03a4042c384cb
-
SHA256
d26080a461a5eb56caf12e0974071d9e8615dd18b8f66f8851ca0de7f5ebb995
-
SHA512
80ded41670d213d6f6e79127027910faff01463f513ebda22336db7d2d6bdf4c72abea6395f2ba9c5b0bd1e89e13f0ad72d94ad82c6cd65f8d596825205491aa
-
SSDEEP
3072:jEGh0oLlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGpl5eKcAEc
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_add0c32186c6990912bc0fe959b309cd_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_add0c32186c6990912bc0fe959b309cd_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F413665-EC41-4c6e-B039-D817C543336E}.exeC:\Windows\{2F413665-EC41-4c6e-B039-D817C543336E}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{116FB92A-6319-4f99-8BE3-308C70796983}.exeC:\Windows\{116FB92A-6319-4f99-8BE3-308C70796983}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D870548-F840-48f3-8C3E-936DA6CDD30B}.exeC:\Windows\{1D870548-F840-48f3-8C3E-936DA6CDD30B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD9FA93D-3E88-472b-9AEF-4AA147F6AA4C}.exeC:\Windows\{AD9FA93D-3E88-472b-9AEF-4AA147F6AA4C}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1959DCA3-3AEB-4abd-AFFE-D42F5F4628C5}.exeC:\Windows\{1959DCA3-3AEB-4abd-AFFE-D42F5F4628C5}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E9F3E190-74CE-4e71-9ECF-B590ECB3460F}.exeC:\Windows\{E9F3E190-74CE-4e71-9ECF-B590ECB3460F}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03FA358D-2438-49fe-B603-BFCFA0938E99}.exeC:\Windows\{03FA358D-2438-49fe-B603-BFCFA0938E99}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF85D7FF-4D8A-4798-B1E9-2702772A1617}.exeC:\Windows\{DF85D7FF-4D8A-4798-B1E9-2702772A1617}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D336D07-A4FC-45d1-A63F-4F8E1F2FA62C}.exeC:\Windows\{8D336D07-A4FC-45d1-A63F-4F8E1F2FA62C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FF6FB0C-3F42-45fb-AD0F-84884DBDE717}.exeC:\Windows\{0FF6FB0C-3F42-45fb-AD0F-84884DBDE717}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1338BA78-E92F-408f-88B0-01D02BB3CD87}.exeC:\Windows\{1338BA78-E92F-408f-88B0-01D02BB3CD87}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{04E19DCF-712E-48ab-888E-C2408EA937F7}.exeC:\Windows\{04E19DCF-712E-48ab-888E-C2408EA937F7}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1338B~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FF6F~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D336~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF85D~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03FA3~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E9F3E~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1959D~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD9FA~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D870~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{116FB~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F413~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD58cb4edae61b7ab9fda7f3196bdf703c5
SHA1f7fb72c884c6c6bafa08ca2ed3d03623632974be
SHA2566dd3647dc2f4c98bd09eb48140ac54981d86b83faac083b67d932059b50dda9d
SHA5128b686e9e512ac9ff8ebb5a9dec0012ffeeb5adcfb4266f29ff0da6f4979037a951da8e1d0e5d5ffc2d3007aff39ce164e1184cb3900e93001182decdad715e11
-
Filesize
180KB
MD57a4b26eec8b77b128e0cb3c7978f4292
SHA14e566e07e98272b4da51fffc4869634bf7ba2aa4
SHA2567ba4b20b8bc7cac9bcf5753e8cc41160a0ae38679887c56773e0387150e5737d
SHA5125ac75e6101233bea2e3eab2be1c5bf1d5b22305a6a9702935d2bb660e7530286ce236d72c3dfb379a3553579778214370851fc8b1c0862eb0011569bb0d6ecfe
-
Filesize
180KB
MD55680265e3dbf4c2fd0bcec5df647f070
SHA10903cc5999394a63a4545c6149d5b6a85a152529
SHA2564d3c3fb7a107b92fb1bddee2775a4c53f9f245fc63caa3e1f4cecf14c219a65f
SHA512877eaebcd20dd987cfdacad422097cc5f2d4cab883bb2869387d00323e6dea5d43c35fd33824ef226331be40fa3a568de3f383fb6a43e5a01cbb58efe93202d8
-
Filesize
180KB
MD55f9da5f0ab78789f830216024647fe50
SHA1b245e872d73adf26be589e5cf7bf2e0e6f34374d
SHA256920bce5c41ba8e93a405436bf7b1fce6f402ee6ef1f508ff5de3e83448ebecd9
SHA512b5f6aee557593522058f0dc91544e5986130bfd4ed2112b2380474376b4883d66eb5e38b3e90162894e105cbe7b3550f84d0e760afc0916186ce851994afe475
-
Filesize
180KB
MD5c86bdce07b2ff10815a1c9f2576d4f7c
SHA1d868df7effcd5a34c0a866b2abfbcb5003e58b7c
SHA25695f2cc247ae9dd7eaf28fe02e15ec77dd4a3a50ac8e3688ba34e609567b158d9
SHA5126b253894d61e6c27b78d8d4820a6132da56457239f467ab8ea2a20bccec15a4342d7e92bee1370c23da90e9bb4b4817fcb1cae5bd3dc0dee577f8b5434e979db
-
Filesize
180KB
MD58b94ec755fb249e10af3dbc55a1312e5
SHA157fe8d88204dd0c0ca7278719c613c496618f3f7
SHA2567704850bcb8a802ce882a9e23b1963bb42054a62d14f3c64313f8aa97b1e22e4
SHA512c139279c4ee7e82652c27fd01399237be8393745ef4c91e2abc1c8f56f9bf51be7245ce025fd9fc14b0bb442c99da2b7b9bf68134784d972ebb9b6effc13bc95
-
Filesize
180KB
MD573664a12432f2c299caef966554e9c26
SHA16e0260fcb746972cc384ae90d7f244e56b1a9da1
SHA256b6193fc40576440e0fc4ab2e54cd044dbc0b723eba6b6c986561f9302268f61b
SHA512f818089723c64e707ab45544023b80c020e1aa7b255aae870e3a426bb8e601069d4cfb037a670af823fc7d046c55cd51edaa4cb542c8e506b5464165ccba3663
-
Filesize
180KB
MD5ff444886ddf0c51fde6f0d892cceb040
SHA12625bc8e8373801ee2fce848ccd278d2215efa69
SHA25607b63c703dd37f0ed6d4b6a4d529b231b865a381bf6e5f8166d13fa941849b5a
SHA5124da9441899bf4d7ad14540c759e4065392486960413a38db004ddc042d3b9eb70d1c00657bcfc1f828529ff116e713f74e7025ec0c9e548e1e2aae6cfd0f3948
-
Filesize
180KB
MD555bb0e69006d510b1ea3ec4b5abc6464
SHA17059d4b1a3c0f353e42270b535f04737c62907c5
SHA2564f4dd9a4c14187c8546f624fa36303288bc5ae5f3c35c6567a92369de64158fc
SHA512f317baee9b83061406bbc6f82e11f27a3cd9ba3107f2514853252d27a8249bb5a6457a73be1e89d18c7cdb3ae685c06e0d4a13b64f1411cc428c217d58a7052a
-
Filesize
180KB
MD5e3ac1d46514658e9eade11305b79c573
SHA1158db02162580ba8e25bd92d816035713404188f
SHA2566bdc86023a950a85df7310f4d441d9767761f4776e9b5b5e4c09a11a447e515f
SHA512bda7f3002513eef6201dd3861af85447f2522afb67212f13b68b2bc92f74a5c9a84cac48ef77165e8f4efd31083e8d7adc585eb8c7808879136825da4c94e836
-
Filesize
180KB
MD558902b082ca67df52655479f9681559b
SHA1655a39d1da76fc4fc8b65bcb17059c87c9a58e02
SHA256c53b586152eb9925a854f04f313d5a4e36284b14df0863f97c4ce6029114988e
SHA5121b2fcb671f17fb107c61d835a4d657cb381dfe064e4f2aad9b7caf2e9bffdc2283037ae022e9df99e7ba857ac742744d25dd3e686ae5289b811d70d90d594a05
-
Filesize
180KB
MD55eab7c88ed574ab4112fb00c1dbfe0d6
SHA1b4e2c6285ef0c7c8a2ade111e381db0f6f5df041
SHA256a3d4f196918c8ed507f33a07bffb5953f9147cb4ab6a5ef9079f3e1182be2bbc
SHA5128400c3b1ee3a97d6bd17f0f9f0468b130b6163b1fdb7a4b88f3c882f905167bdaa39d320f00dad74b1e984a91ebabfd71aa4282bc4354968e042e7b818f64322