kinsing | 17d76f5eedc6baad47a92a371d8d52521bf51c09fa794cb36816dcd0dc938630

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe
Size

37KB
MD5

f6bff67e630183ca574c3f561832210b
SHA1

5a658e017600ce7087930706117cf55e86f1cbfb
SHA256

17d76f5eedc6baad47a92a371d8d52521bf51c09fa794cb36816dcd0dc938630
SHA512

1d7b2a2f349d03101ed9b7bacbad9b647598df89afce6edb59e50dac01bbb2a74a043fbb67446d762261099f0390bd2321c9a8dd591b1d5cc21da1a3564b528f
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3Nb/mViF:bAvJCYOOvbRPDEgXrNekd7l94i3p/ht

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\demka.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exedemka.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

Processes:

demka.exe

pid process

4632 demka.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4632	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe

description	pid	process	target process
PID 3216 wrote to memory of 4632	3216	2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe	demka.exe
PID 3216 wrote to memory of 4632	3216	2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe	demka.exe
PID 3216 wrote to memory of 4632	3216	2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe	demka.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f6bff67e630183ca574c3f561832210b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3216

C:\Users\Admin\AppData\Local\Temp\demka.exe
"C:\Users\Admin\AppData\Local\Temp\demka.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe
Filesize
37KB

MD5
bb1b770a5c9b351fb149503dacc825e6

SHA1
b50af40cdf99a2890ef6c58f75cce20485bda9a6

SHA256
5f287112722dc2ef3fb0f14b792604b55428f82d1f2d0c6c14a8c26d297b31e7

SHA512
15f702823867d72e7fa1ced66092631b170e04962f820ffa3ec73aef1d94429e6a931b7753d756184da1000543700a2f9f8fa67282f147151dd13c0a3480accf

Download Submit
memory/3216-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3216-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3216-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4632-20-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download