kinsing | cabaef68fd2718b6b1e7e4797b351d264c772ba1aec487652cac0c0eecd79dfb

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751c10b68e377f8739095de826f6f719.exe
Size

6.9MB
MD5

751c10b68e377f8739095de826f6f719
SHA1

39306462cee8527aff24dace67451ba42acf803e
SHA256

cabaef68fd2718b6b1e7e4797b351d264c772ba1aec487652cac0c0eecd79dfb
SHA512

b23bc4ace18bed391ab9b0b1085f2e6036384e4c8c8d3bc977c576aabd56747cdb33735e1f4aeb9f4315fae19d7daa0126804a1d73ba2233372da7ce06512d72
SSDEEP

196608:wf23wCrVEG77LLgiIZuSIXf2Rguaf5QkSYthJY:we3wOB7gpZuSef2RAWAtg

Score

10^/10

kinsing loader upx

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Executes dropped EXE 1 IoCs

Processes:

irsetup.exe

pid process

3436 irsetup.exe

pid	process
3436	irsetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe	upx
behavioral2/memory/3436-4-0x0000000000400000-0x0000000000527000-memory.dmp	upx
behavioral2/memory/3436-15-0x0000000000400000-0x0000000000527000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

irsetup.exe

description ioc process

File opened for modification C:\Windows\°ÁÔ½ÒôÀÖ¿ÌÂ¼ Setup Log.txt irsetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

irsetup.exe

pid process

3436 irsetup.exe
3436 irsetup.exe

description	ioc	process
File opened for modification	C:\Windows\°ÁÔ½ÒôÀÖ¿ÌÂ¼ Setup Log.txt	irsetup.exe

pid	process
3436	irsetup.exe
3436	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

751c10b68e377f8739095de826f6f719.exe

description	pid	process	target process
PID 2040 wrote to memory of 3436	2040	751c10b68e377f8739095de826f6f719.exe	irsetup.exe
PID 2040 wrote to memory of 3436	2040	751c10b68e377f8739095de826f6f719.exe	irsetup.exe
PID 2040 wrote to memory of 3436	2040	751c10b68e377f8739095de826f6f719.exe	irsetup.exe

C:\Users\Admin\AppData\Local\Temp\751c10b68e377f8739095de826f6f719.exe
"C:\Users\Admin\AppData\Local\Temp\751c10b68e377f8739095de826f6f719.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
__IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\751c10b68e377f8739095de826f6f719.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
Filesize
440KB

MD5
75ca7ff96bf5a316c3af2de6a412bd54

SHA1
0a093950790ff0dddff6f5f29c6b02c10997e0c5

SHA256
d95b5bf9ca97c1900de5357743282bab655d61d616606485088e1708559b7cf1

SHA512
b8da86f2f1e908955254e5168d0447f479cec7815a8b081a7b38eb87187cb2eb992109c67e006361b96bc1529ee8abc9dc477d78e9ca565e43f5415b492771d4

Download Submit
memory/3436-4-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/3436-15-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download