Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:37
General
-
Target
2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe
-
Size
180KB
-
MD5
c38a1ee7a2fc8a8b51794c4507367763
-
SHA1
9f7ffbb73f95484b306909a9335aa354f78ff6aa
-
SHA256
5d9f1973f2ec098801c0e432c5452fc74da5cf7a5406e70d535c85f9b71e66a5
-
SHA512
ad2c3c48ff14544f85384f94b4e3ab9628b610fd7794b1dbf3dff04a3fde73b603043ba08c680070a8b118c5f64a3251068233651f1b110206090b27933ff01d
-
SSDEEP
3072:jEGh0omlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG4l5eKcAEc
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_c38a1ee7a2fc8a8b51794c4507367763_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EB1622B-68A3-4e32-B4BA-ACE2C54AB75A}.exeC:\Windows\{7EB1622B-68A3-4e32-B4BA-ACE2C54AB75A}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51E70146-1B83-4898-9822-863C03A3DD16}.exeC:\Windows\{51E70146-1B83-4898-9822-863C03A3DD16}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51E70~1.EXE > nul4⤵
-
C:\Windows\{549A3C51-9BDA-4b62-B9CB-4F53881B8A4C}.exeC:\Windows\{549A3C51-9BDA-4b62-B9CB-4F53881B8A4C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{237B8235-A692-4210-8215-42138B313AD6}.exeC:\Windows\{237B8235-A692-4210-8215-42138B313AD6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{237B8~1.EXE > nul6⤵
-
C:\Windows\{9E2CEA35-0C0A-42fc-9076-07854D2D05E9}.exeC:\Windows\{9E2CEA35-0C0A-42fc-9076-07854D2D05E9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E2CE~1.EXE > nul7⤵
-
C:\Windows\{A1F25698-5C55-4306-A01C-0351A7E8B4D1}.exeC:\Windows\{A1F25698-5C55-4306-A01C-0351A7E8B4D1}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56242C18-F26A-4019-9438-F64128E548A7}.exeC:\Windows\{56242C18-F26A-4019-9438-F64128E548A7}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAABA5AD-D1BE-43ba-AA9B-E6AA152F276E}.exeC:\Windows\{BAABA5AD-D1BE-43ba-AA9B-E6AA152F276E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{133F6D0E-34CD-42f3-A145-3E0E68096AAA}.exeC:\Windows\{133F6D0E-34CD-42f3-A145-3E0E68096AAA}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86AEAFEC-2EA7-46a8-B822-B02868EE48DA}.exeC:\Windows\{86AEAFEC-2EA7-46a8-B822-B02868EE48DA}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86AEA~1.EXE > nul12⤵
-
C:\Windows\{774B8040-6332-4a12-9EE0-A7B90CB78FB8}.exeC:\Windows\{774B8040-6332-4a12-9EE0-A7B90CB78FB8}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{774B8~1.EXE > nul13⤵
-
C:\Windows\{3FEA1975-C641-4f35-9CE4-DE5F802BEBFE}.exeC:\Windows\{3FEA1975-C641-4f35-9CE4-DE5F802BEBFE}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{133F6~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAABA~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56242~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1F25~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{549A3~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EB16~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5f00a1b5da2a72a8906497ac192f2126d
SHA16bb1a8c49646ace37c42b1f0b639e729b2a698e3
SHA256629dce38daed1e6ec1a83e7f64de992ca8199f882cf79c814047679e17b84f97
SHA512a1a3aa556d32e6f4071e0f32ef0e62263325dcff078966a730dcb71b7953e800ee1e6b1ae54be646bbcc7ee2420cff14099f465518e200add8c8b4c1cc2ebe1c
-
Filesize
180KB
MD5296ed0340ba14ff991d342dd933b4e1f
SHA1eccbb2a734839a79ad25fe83a62d3fe8071475af
SHA256ede5fc8d5c583c9870d9e7bd335a4778872949c061aa2ecb8b4fd2390e996035
SHA512a9f153b7fdd7a133a68617007a7ef78857d5f047f884941ecf4deb260dfa58b8a8d827d0fb60d8af2a7aea5a1f8fdd256b524aeffdef21b7db22a6d7020e5777
-
Filesize
180KB
MD591a9c1a8af8f5220b14c03a97b1ce6d0
SHA1fab379ff06ab67f7fabdaa9bd8fa6f6e696f41d5
SHA2568e8fda1a9bdea89bc292a996d959c6a0a376c4fea204e131eb57665917e76480
SHA5127d7ef0ddc2dde9a4e79c94b2131e756e782470c32b7ec3adc5c77d86bd23c3a9335863e6f9005f1625f52b9c8c64bf5dc0b57632d25591f0ffa46dc9ff5dfd03
-
Filesize
180KB
MD5f4169f68df5592f8b3c1b57aafa84102
SHA14a47ff6c0f68f724e326e638f2f151d4f54a5cac
SHA2566e669720a2f6ce76d8f82b0b36c047d6af90fa780925a1a66ddcd01af0e78c76
SHA512c02e9926fa4a70db73d5572daa0d2842531caf814f6d909964828fb923b2c8a0f6ca9c5c6f565f4c608f8c2208a12111d32fe6a58d1e6b7283f14fa890f87a3a
-
Filesize
180KB
MD546ce47fde58aebfcfefaa51ce237af85
SHA187dd40ad6ff2c5fdb69314305857e819674b17d3
SHA256babcc30ae6a7b72d767eac88ca3cba6584c85798005a2c85f2f0c7eb4fc227c0
SHA512f0f4aba4f854e863355a1d42bfc817d47fbec9c2a81749ea51f61a3727c75c444f316d0d66aa9113aa6fb04e5fb6957d4300b1ed2f2fe77f75fd65a2a156677f
-
Filesize
180KB
MD593a94bb56336c24d3576d8419d6cb5b9
SHA100f299788752363f2da5af8f99c2fe85b056b5e0
SHA256ef063e7127e1b1e881fe2e143504e3facad312205afde650a6f42ed5dc8a969b
SHA51203c2083fbca8fa099deff99b732ead1dc5c5e13213d9c7a3329d2d674df5b627c0ddc527cb9e11a0946c38cd10a03b4278c92b37772eea3fd2820dbc45c50668
-
Filesize
180KB
MD5c598a79b03182a3a806eec04d467cecb
SHA11b94bdf992054194b660038dae0f1a025a01dc87
SHA256ea690e33899bc973dd1cbc9fa2121db0e281b6763cca03c7111449ea2f81d7f9
SHA512475111bab9ea85c7b5cdd239e0657d679e71370e020a564302717ee043a5773d54e75ba2cfe9043cb0686b2aa0da50d70d08d1a64b4dd1fa2f959af1b80d349f
-
Filesize
180KB
MD526165d1498b4136eb952c3d5042cd3c3
SHA1451bc93acc40f762bcdd5486e5603ef73a391a52
SHA256c6a78393b269b48b87d8fd89a0d2a42afb17ede5bcb026999c973ad60352ee37
SHA51202430b061cdd2db89010cef2ae3ea1de51c6052e83062d487d9c91d6471bbcae908c1d9f10646cd4d362bb132e26d76f459938abad140db3c15e260962de6782
-
Filesize
180KB
MD5d12244ab0b732477bf4d99e465cc672e
SHA1757f0091489154699fe0fa4f75169de074357623
SHA25691198cd4606f299bbac5f57d04a12d225175d95545ccb5365c280216d66662cf
SHA512cc65536fa38f7177a8e56a1dc78d8d2e2019d9abe5ece7e4056bd2c4121aa38d98f9edbf6cdd67c9a36d7d6c3cd2109aca15da7f5c8ef5037d44c566e68b417e
-
Filesize
180KB
MD59c0189b6fdadd7b6d51c2d74f7a02648
SHA1c79ae3b32dd46bb01420697406d80daf2215160b
SHA2565eb3140d9f420d736ee309b74e6ef848838d81767601058a2baac65bf7452c0c
SHA512ab21119c44eb20b8aa6bd13f1b3846c23fb50ac306e4f09fddfbf79c4d7f10b1959fcbc880a3a82d71b8ae0c972ac8b182c2e2cc488e46b9757462039b8a31f9
-
Filesize
180KB
MD50c7dd4473744c6ff7cade67a334ffdad
SHA11d015f424c4957510e98286df3bd511832cb16a5
SHA256a686575c57fbb4cae369415ac88351b22b8e0eb4b6851888a98802da958eb606
SHA512b514bf3f3e61288e39c0090c43d9dd3c38eed00cede22a5dabf69def77141e862d49d2639e3ead2a550887b3f2e922281247792137cb264f9ad52cd26130fa21
-
Filesize
180KB
MD50da60c59bcf98d48b3da20889df95eba
SHA180e637bfecba573a4617d2b304a0014ecd616d90
SHA256c140a85f10fb40f9bae747686fdbd01de82f3a7ecf6adb0f95d79f8f8514e4c4
SHA512784c1e22600c2d316408c28ed05fb12c136274b19df00a0c924a7297d164652a0e2576d25fc3338d2ec28311c7986445bda7522c54100095c67fbd8e880aa95f