kinsing | 4794205743fec20338d5432ebf4ffb7cc72a63c77bd4aa3d7ee0cbcae09599e5

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe
Size

45KB
MD5

e4ddd4de4ab282546388bba3f3c080aa
SHA1

b36f765c7a30943431be5c9c5992799dfa046ac6
SHA256

4794205743fec20338d5432ebf4ffb7cc72a63c77bd4aa3d7ee0cbcae09599e5
SHA512

d540881d571f3a9ffc7cd713109ff3111062e675a03d322d3cbbc32a403bfc35f67e8045ee394bde26f076e2764b8e2f9d408186bdd16df43ccb29fe09dd9819
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1ws3:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1J

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0009000000022480-13.dat	CryptoLocker_rule2
behavioral2/memory/1916-17-0x00000000004F0000-0x0000000000500000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

misid.exe2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid	Process
1916	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe

description	pid	Process	procid_target
PID 1000 wrote to memory of 1916	1000	2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe	89
PID 1000 wrote to memory of 1916	1000	2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe	89
PID 1000 wrote to memory of 1916	1000	2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_e4ddd4de4ab282546388bba3f3c080aa_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
7340663ed3af2a6675bcbf7edaebcdfe

SHA1
17f4bda0b3ff45c1bf590c4db14057cb1c5ace63

SHA256
2ce6ad111a9ab18925fa902703392e32bbd06469ee80a94cf597b2b3295f00f1

SHA512
c23e4d86bf785a250ea19f28ce87190138a2fccf9590c7eb612f3dfe9b19e8767d54288d8fafc7e14f211ec7b8f7359012af6a82b3dc25cb7ff35559d8669000

Download Submit
memory/1000-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/1000-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1000-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1000-3-0x0000000000720000-0x0000000000726000-memory.dmp

Filesize
24KB

Download
memory/1000-21-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/1916-17-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/1916-19-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/1916-22-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download