kinsing | 3caa0329ccc10b15195ad2cc9eca48c78d053ce85be71262721a8d0a6b2a1953

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe
Size

31KB
MD5

bc8d787dd7e65b0f128d8282b842aff9
SHA1

13e89ec190da1f31b2c7a35d2f3791f08cc17a17
SHA256

3caa0329ccc10b15195ad2cc9eca48c78d053ce85be71262721a8d0a6b2a1953
SHA512

4c52a86e3cca8583ac727c08e6ffb4255f94c256b2427666ce0a272bbc82ca96296ff008bd60d0a6e6ea873327f7b5c1adf4a1043113e0b1e7d6a63b27bee5eb
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cuM932:bAvJCYOOvbRPDEgXRcuM9m

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x001500000001e2b4-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exedemka.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

Processes:

demka.exe

pid	Process
4428	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe

description	pid	Process	procid_target
PID 2816 wrote to memory of 4428	2816	2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe	89
PID 2816 wrote to memory of 4428	2816	2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe	89
PID 2816 wrote to memory of 4428	2816	2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_bc8d787dd7e65b0f128d8282b842aff9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
a136dde8d499ccd170ec2f52a79f9641

SHA1
a9081398cb6439b2accae7cb6acdf6b835e6b510

SHA256
b3e98636e7c5cd948c84b0061b5b5d5d8b543b6d5f39059f7664b488f2d1530b

SHA512
5c45a15639fad17e2b82e86c44e5558172fb34c3d9c51180d8db3ca645c75369aca6e89af21604d908f2683b90c8554f212d785a176dd35fe6ccffe17522941e

Download Submit
memory/2816-0-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/2816-1-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/2816-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4428-24-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download