kinsing | f492fa8dc36e8dee420dfa4ece692781aa682b6b8e2d9f97a1d8c2cf595d98bd

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:52

Target

75046772bbda9fea06dfa5022ab066e0.exe
Size

10.7MB
MD5

75046772bbda9fea06dfa5022ab066e0
SHA1

11830d82eab21df474007e07187b10a4b861cf2f
SHA256

f492fa8dc36e8dee420dfa4ece692781aa682b6b8e2d9f97a1d8c2cf595d98bd
SHA512

aa566365dcf5117f6c86b7be4fd3da5cc349ead93182a6ab111d6163c1106b913e6ee9bf884272fbfcce49b7d4af097849aba14349aa840707fe8f97df0f44b8
SSDEEP

196608:zJZArxqDkTv1B2gvkaAGVU81B2gvkaASKu5jF1B2gvkaAGVU81B2gvkaA:9ZMqYTvnRkonRkYFnRkonRk

Score

10^/10

kinsing loader upx

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

75046772bbda9fea06dfa5022ab066e0.exe

pid process

3408 75046772bbda9fea06dfa5022ab066e0.exe
Executes dropped EXE 1 IoCs

Processes:

75046772bbda9fea06dfa5022ab066e0.exe

pid process

3408 75046772bbda9fea06dfa5022ab066e0.exe

pid	process
3408	75046772bbda9fea06dfa5022ab066e0.exe

pid	process
3408	75046772bbda9fea06dfa5022ab066e0.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4548-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\75046772bbda9fea06dfa5022ab066e0.exe	upx
behavioral2/memory/3408-14-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

75046772bbda9fea06dfa5022ab066e0.exe

pid process

4548 75046772bbda9fea06dfa5022ab066e0.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

75046772bbda9fea06dfa5022ab066e0.exe75046772bbda9fea06dfa5022ab066e0.exe

pid process

4548 75046772bbda9fea06dfa5022ab066e0.exe
3408 75046772bbda9fea06dfa5022ab066e0.exe

pid	process
4548	75046772bbda9fea06dfa5022ab066e0.exe

pid	process
4548	75046772bbda9fea06dfa5022ab066e0.exe
3408	75046772bbda9fea06dfa5022ab066e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

75046772bbda9fea06dfa5022ab066e0.exe

description	pid	process	target process
PID 4548 wrote to memory of 3408	4548	75046772bbda9fea06dfa5022ab066e0.exe	75046772bbda9fea06dfa5022ab066e0.exe
PID 4548 wrote to memory of 3408	4548	75046772bbda9fea06dfa5022ab066e0.exe	75046772bbda9fea06dfa5022ab066e0.exe
PID 4548 wrote to memory of 3408	4548	75046772bbda9fea06dfa5022ab066e0.exe	75046772bbda9fea06dfa5022ab066e0.exe

C:\Users\Admin\AppData\Local\Temp\75046772bbda9fea06dfa5022ab066e0.exe
Filesize
181KB

MD5
2512a17d361e57ce2b0528ecfe1a09ff

SHA1
c5ebbe89e0c4e78144a56d45e5400b6937447b4b

SHA256
6dce8ddc26c2794fdb4bde82f5df6ff6f1c3c2f8b05af946dea6402e19468fd6

SHA512
322edf4fcdc10f336f3b30ebada2b08297b8cb6e53a301686ffeb8340a4dc3f6247a8bda2e3267762d2dc38add2743f782606c12164851fc6b4b4dfa8ed32d40

Download Submit
memory/3408-14-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/3408-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3408-16-0x0000000001870000-0x0000000001982000-memory.dmp

Filesize
1.1MB

Download
memory/3408-23-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/4548-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/4548-1-0x0000000001CE0000-0x0000000001DF2000-memory.dmp

Filesize
1.1MB

Download
memory/4548-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/4548-13-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download