Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:35
General
-
Target
751bbb23bcf8ee61ae292ca47eeca991.exe
-
Size
5.3MB
-
MD5
751bbb23bcf8ee61ae292ca47eeca991
-
SHA1
24cba516d0d043d401e5dc94f08c771ab5cfbce5
-
SHA256
de2058855ca75f93be81dd6f8acddd29fa378500ce8bf7e6a90b52045082ee88
-
SHA512
2be4b4fc4e3790c3b797c5e50369f1c931fe2ef5dbedf8511c66c3d8d1e525101b3580b7afc1280e57c6f4012a7296dbdd7ae5a68448fe5ff48021166bb14fe6
-
SSDEEP
98304:4Z7KYK31oifL8cZXwHktBcwQDM2YIDULHweOWL8JuyTn3SJxnxJHktBcwQDM2YIO:4FKYK31oEL8cZgschDHIQtW4rzSPnLs5
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\751bbb23bcf8ee61ae292ca47eeca991.exe"C:\Users\Admin\AppData\Local\Temp\751bbb23bcf8ee61ae292ca47eeca991.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\751bbb23bcf8ee61ae292ca47eeca991.exeC:\Users\Admin\AppData\Local\Temp\751bbb23bcf8ee61ae292ca47eeca991.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
920KB
MD51f7fd82f3edacaf49380f22600996065
SHA1fb83eecb2fc1e99f5d0070a9c2208eb04403696a
SHA256c79b1ced64b2ec4d2efa8f48613476a832f722302249f64f79f86fd115545989
SHA5126b998916fc42fb932666827a0788c6b1d35a5d825c51607467a919981933696c37b53ec4e6eaa2eeaa6613713540807f63126d12b21db4acbcaab7a28a4f1604
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB