kinsing | 4646f12dc681b5c30ff7085d02ae0b0ba290ca599170d3a3ec1b703c5f194692 | Triage

Analysis

max time kernel
105s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:37

Sharing

Report Analysis Logs

General

Target

751c77b37547b1e9857785ee34dbc194.dll
Size

83KB
MD5

751c77b37547b1e9857785ee34dbc194
SHA1

ff0a372105551a1da97fa0d389dbdb7022b90c00
SHA256

4646f12dc681b5c30ff7085d02ae0b0ba290ca599170d3a3ec1b703c5f194692
SHA512

6d52df82b05c29b4c21d33b51967d9a2753f305a3c27619723cd21b379c32f1c18b20c6bb9744b082ce2d68c8d99867878c71c3f8deecf48c65553d6ee35f641
SSDEEP

1536:U4K+Fijll+nM5LaOAA0KGnem0nyEIPBzzd:U4DF64c9AAmeyJh

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 468 wrote to memory of 2824	468	rundll32.exe	86
PID 468 wrote to memory of 2824	468	rundll32.exe	86
PID 468 wrote to memory of 2824	468	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\751c77b37547b1e9857785ee34dbc194.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\751c77b37547b1e9857785ee34dbc194.dll,#1
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download