kinsing | f3104df55153bd45a3b51c561038992c56439531f512b4f4df0a3ceaf191518e

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:47

Target

75017e38f786c4144ed26b4afc36915d.exe
Size

82KB
MD5

75017e38f786c4144ed26b4afc36915d
SHA1

5461b0641870b3cb98e78d6e0ef5ebf3af9296e3
SHA256

f3104df55153bd45a3b51c561038992c56439531f512b4f4df0a3ceaf191518e
SHA512

cc5f83eb111b2aaea3275cae8cb3d824512b393089d9e9994f3f88f8379b2b41e1eeff6212ecf10dc41f3ef76d12a1b6bb2391b11a5fedd45b3239994f9f6f16
SSDEEP

1536:V1cs5SYm3S1r49dXJ+hzswYa91gnzWJdgX/:V1c+m3or49dXsSwY21gz//

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

75017e38f786c4144ed26b4afc36915d.exe

pid process

5012 75017e38f786c4144ed26b4afc36915d.exe
Executes dropped EXE 1 IoCs

Processes:

75017e38f786c4144ed26b4afc36915d.exe

pid process

5012 75017e38f786c4144ed26b4afc36915d.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

75017e38f786c4144ed26b4afc36915d.exe

pid process

2740 75017e38f786c4144ed26b4afc36915d.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

75017e38f786c4144ed26b4afc36915d.exe75017e38f786c4144ed26b4afc36915d.exe

pid process

2740 75017e38f786c4144ed26b4afc36915d.exe
5012 75017e38f786c4144ed26b4afc36915d.exe

pid	process
5012	75017e38f786c4144ed26b4afc36915d.exe

pid	process
5012	75017e38f786c4144ed26b4afc36915d.exe

pid	process
2740	75017e38f786c4144ed26b4afc36915d.exe

pid	process
2740	75017e38f786c4144ed26b4afc36915d.exe
5012	75017e38f786c4144ed26b4afc36915d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

75017e38f786c4144ed26b4afc36915d.exe

description	pid	process	target process
PID 2740 wrote to memory of 5012	2740	75017e38f786c4144ed26b4afc36915d.exe	75017e38f786c4144ed26b4afc36915d.exe
PID 2740 wrote to memory of 5012	2740	75017e38f786c4144ed26b4afc36915d.exe	75017e38f786c4144ed26b4afc36915d.exe
PID 2740 wrote to memory of 5012	2740	75017e38f786c4144ed26b4afc36915d.exe	75017e38f786c4144ed26b4afc36915d.exe

C:\Users\Admin\AppData\Local\Temp\75017e38f786c4144ed26b4afc36915d.exe
Filesize
82KB

MD5
28e1223ffcd00ed9ecde4fa57da64fbe

SHA1
871cd8c8a5903356b7496676de32da0108f6ffb7

SHA256
dc8d835b310b50feae41d78b430545e3caf1706f3fe0fb5a249180861f8d5499

SHA512
4450271df3bafd64756532a8b965db41feed43600b3316f11b89f59112471539d0872f4891c89e8a3d0302099469b860d7687da58ebcd7e3e9610edd9faa731c

Download Submit
memory/2740-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2740-1-0x0000000001500000-0x000000000152F000-memory.dmp

Filesize
188KB

Download
memory/2740-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2740-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5012-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5012-14-0x0000000001500000-0x000000000152F000-memory.dmp

Filesize
188KB

Download
memory/5012-25-0x0000000004D90000-0x0000000004DAB000-memory.dmp

Filesize
108KB

Download
memory/5012-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download