Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:36

General

  • Target

    91See_QuickView/QuickView.exe

  • Size

    360KB

  • MD5

    6bf490d38353f433e29853c738f9d404

  • SHA1

    d9705d0913bcba600d43d30e5b8420daa4ec31b1

  • SHA256

    82638f82059210df03db8eb3d314134a1f2dc7241aceed74cc525cdefcca0e62

  • SHA512

    23dd3370b5818e4c85d05607a0c8991cc162d91441e24d0779e80e4eaa32300cf448e358ea41612764604f1b71e5d84bd37a0a47fcd0ff1e27ce3c156dab9eb6

  • SSDEEP

    6144:AJ2AKpLejuIx1Slt3JNx7wM1uywk7z7D508gEXypKyj6353Q9taMzPM7zO0QlSVa:AJ2AKpLejug1Slt3JNx7wM1t3908749L

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91See_QuickView\QuickView.exe
    "C:\Users\Admin\AppData\Local\Temp\91See_QuickView\QuickView.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3180-1-0x0000000000A40000-0x0000000000A59000-memory.dmp

    Filesize

    100KB

  • memory/3180-0-0x0000000000A20000-0x0000000000A33000-memory.dmp

    Filesize

    76KB

  • memory/3180-4-0x0000000000A60000-0x0000000000A6F000-memory.dmp

    Filesize

    60KB

  • memory/3180-6-0x0000000000AA0000-0x0000000000ABA000-memory.dmp

    Filesize

    104KB

  • memory/3180-5-0x0000000000A80000-0x0000000000A93000-memory.dmp

    Filesize

    76KB

  • memory/3180-11-0x0000000060900000-0x0000000060969000-memory.dmp

    Filesize

    420KB