Overview

overview

10

Static

static

3

75040c1a74...b2.exe

windows7-x64

7

75040c1a74...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 16:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75040c1a74a31abdc4af17cabd8c8fb2.exe

  • Size

    1.0MB

  • MD5

    75040c1a74a31abdc4af17cabd8c8fb2

  • SHA1

    a46b5bfa504520613e45ed6e6df47389edcc8a58

  • SHA256

    30536677c8b12cd7f55e4a0a3c7dd88ea95eb32ba3cada27a5a15d3a6b7b12cb

  • SHA512

    dabd1246356ab5499413ab2789b85cb87e43da012ff982d34b93fe8688d8b3b551948849703f1ac45b3a06a2ecc56b62f06d487c6ed9c15b2720f7c5b4ad0cd9

  • SSDEEP

    24576:XhpNuBnD4OVNFK6DzInUrxoo6zQGzEvkbhI+BvhNG5Ey8AhGu+2AY0:XhtOVNFNzInUrEzRAkVI0vhwa2ByY0

Score
10/10
kinsingloader

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75040c1a74a31abdc4af17cabd8c8fb2.exe
    "C:\Users\Admin\AppData\Local\Temp\75040c1a74a31abdc4af17cabd8c8fb2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
    Filesize

    1.1MB

    MD5

    638e737b2293cf7b1f14c0b4fb1f3289

    SHA1

    f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

    SHA256

    baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

    SHA512

    4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

    Download Submit
  • memory/4800-0-0x0000000000400000-0x0000000000445000-memory.dmp
    Filesize

    276KB

    Download
  • memory/4800-9-0x0000000000400000-0x0000000000445000-memory.dmp
    Filesize

    276KB

    Download