kinsing | bd61a0f889eee98bb045244f838965ba058c72d9882af9767734f262f042b0c2

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:59

Target

75080b53976515b2848f00b996d34398.exe
Size

169KB
MD5

75080b53976515b2848f00b996d34398
SHA1

ee0a6934612dd2a6710c6f5f3140092cc8ffbb8d
SHA256

bd61a0f889eee98bb045244f838965ba058c72d9882af9767734f262f042b0c2
SHA512

51ccd8e9e6722b79aa9700b620ad50e72219320010700be87b76b1136ed0099f2f71a03c77e58b41dd9b77b52af9535ac87d004368b7216e114b57a6100e89cd
SSDEEP

3072:fk1G5P2SP6mDjPBiK8zy1J1Y+F2M46X6t1e75bCyZ94hi1ffHef0ZgUKRE2Nrrdx:aiPRPlDjJB8z+F2gX975jUEeseUTUXdx

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

1704 75080b53976515b2848f00b996d34398.exe
Executes dropped EXE 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

1704 75080b53976515b2848f00b996d34398.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

2252 75080b53976515b2848f00b996d34398.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe75080b53976515b2848f00b996d34398.exe

pid process

2252 75080b53976515b2848f00b996d34398.exe
1704 75080b53976515b2848f00b996d34398.exe

pid	process
1704	75080b53976515b2848f00b996d34398.exe

pid	process
1704	75080b53976515b2848f00b996d34398.exe

pid	process
2252	75080b53976515b2848f00b996d34398.exe

pid	process
2252	75080b53976515b2848f00b996d34398.exe
1704	75080b53976515b2848f00b996d34398.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

description	pid	process	target process
PID 2252 wrote to memory of 1704	2252	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe
PID 2252 wrote to memory of 1704	2252	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe
PID 2252 wrote to memory of 1704	2252	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe

C:\Users\Admin\AppData\Local\Temp\75080b53976515b2848f00b996d34398.exe
Filesize
169KB

MD5
00a3b91cced02b061d53020659069b93

SHA1
f38767ad61c5bf008055e149f7839e41a7dc4540

SHA256
6ddf57712aae4714eeca59e676824c006348b0f4c3e04d7875bd3155e9c2a438

SHA512
7b4df83c7f6494f921918d7ddf2648863dc271a64e9ed1f1f0eb9984e90e32fddae13f82aaa0c4c7ec56feff55675a13ca3fba2e0f91068dac911af5c71bdba9

Download Submit
memory/1704-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-14-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/1704-25-0x00000000015E0000-0x00000000015FB000-memory.dmp

Filesize
108KB

Download
memory/1704-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2252-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2252-1-0x0000000001500000-0x000000000152F000-memory.dmp

Filesize
188KB

Download
memory/2252-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download