kinsing | a4b8ae7dd41e3b74ac8c4e7f18961b310d3868dd869501eadc95c50eaa1be64f | Triage

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:35

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

3.4MB
MD5

03a27a240c6cd820547266fcb39d58de
SHA1

9909a4eaf49b55753e4bb65fec3f6ace9776496d
SHA256

a4b8ae7dd41e3b74ac8c4e7f18961b310d3868dd869501eadc95c50eaa1be64f
SHA512

1ccd203eef659aac9c4209c63b094ba89936021ee8f3864b0df61b98f1e6166c4ad5b0d5d9038d1dba717e9f82c8f81cba79483a971a76f61c6cedd0e44d14a7
SSDEEP

98304:Lke6FPl+8aoJHAz3IfcPAS0M9RB/aTFLOAkGkzdnEVomFHKnPqe68:wHWsoH+yRB/aTFLOyomFHKnPHp

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

tmp.exe

pid process

3800 tmp.exe
3800 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 3800 tmp.exe
Token: SeDebugPrivilege 3800 tmp.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tmp.exe

pid process

3800 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-2-0x0000000002DF0000-0x0000000002E0E000-memory.dmp

Filesize
120KB

Download
memory/3800-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download