Malware Analysis Report

2024-10-19 08:31

Sample ID 240125-v95wfsbhf7
Target 751f2d5097fc2ba1bebf9170bda56a14
SHA256 c9cc5c0b7d439c7881227618879dc53ea07ddb4b649cef39fc0a1b1da6c4d476
Tags
evasion spyware stealer trojan kinsing loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c9cc5c0b7d439c7881227618879dc53ea07ddb4b649cef39fc0a1b1da6c4d476

Threat Level: Known bad

The file 751f2d5097fc2ba1bebf9170bda56a14 was found to be: Known bad.

Malicious Activity Summary

evasion spyware stealer trojan kinsing loader

Kinsing

Executes dropped EXE

Reads user/profile data of web browsers

Checks whether UAC is enabled

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-25 17:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-25 17:42

Reported

2024-01-25 17:45

Platform

win7-20231215-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\LocalLow\cookieman.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe

"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"

C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe

"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890"

C:\Users\Admin\AppData\LocalLow\cookieman.exe

"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com

Network

Country Destination Domain Proto
US 8.8.8.8:53 installer.freeze.com udp
US 8.8.8.8:53 dl.installiq.com udp
US 69.162.95.5:80 dl.installiq.com tcp
US 8.8.8.8:53 ww1.installiq.com udp
US 208.91.196.145:80 ww1.installiq.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890\autorun.txt

MD5 dedd637ddbf046e30073a331661f9c07
SHA1 ab5f8164ea28c3b43ef05d20a45fe05d56b55362
SHA256 ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722
SHA512 c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65

C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890\wrapper.xml

MD5 1d45a29e3511b982a1f91b33c70e964f
SHA1 176a47b489be3f27dc354a2b9dd0b580bb2f3904
SHA256 0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc
SHA512 c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

C:\Users\Admin\AppData\LocalLow\cookieman.exe

MD5 3e382f6385bf86f976aecc9c2c3c6552
SHA1 d8c658bc164cb8bce72e5cca0597406841105685
SHA256 f2327ccb290c23f00af6555afc7f1c2855ef599ae387022a7f785d6cb47fceae
SHA512 656ee17c403d6aef18faad8eff0e4c305cb0f18ac22fe55b5b6b3400a560f45445f5fe0f21140ee36fb0de6cbe9abb3185a3c2caf0cbafd4d0bcdbf9ae20396b

C:\Users\Admin\AppData\LocalLow\cookie.ini

MD5 3f4519b56cb1e006dfe4341e72112913
SHA1 0ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA256 125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
SHA512 78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-25 17:42

Reported

2024-01-25 17:45

Platform

win10v2004-20231215-en

Max time kernel

142s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"

Signatures

Kinsing

loader kinsing

Reads user/profile data of web browsers

spyware stealer

Processes

C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe

"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"

C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe

"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_112a26680"

Network

Country Destination Domain Proto
US 8.8.8.8:53 installer.freeze.com udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 dl.installiq.com udp
US 69.162.95.5:80 dl.installiq.com tcp
US 8.8.8.8:53 5.95.162.69.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\pkg_112a26680\autorun.txt

MD5 dedd637ddbf046e30073a331661f9c07
SHA1 ab5f8164ea28c3b43ef05d20a45fe05d56b55362
SHA256 ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722
SHA512 c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65

C:\Users\Admin\AppData\Local\Temp\pkg_112a26680\wrapper.xml

MD5 1d45a29e3511b982a1f91b33c70e964f
SHA1 176a47b489be3f27dc354a2b9dd0b580bb2f3904
SHA256 0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc
SHA512 c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69