kinsing | bd5cb2e1d599b8cfc30a8afbac70baad31c180d39731283a967dbd51d47f8c2f

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:07

Target

750cb749a845c19ce711fa7ab6c70c2f.exe
Size

1.9MB
MD5

750cb749a845c19ce711fa7ab6c70c2f
SHA1

e63f680a45b43f6e04dd205ae55c4d35637bc1c1
SHA256

bd5cb2e1d599b8cfc30a8afbac70baad31c180d39731283a967dbd51d47f8c2f
SHA512

8cc2222af87ac8df3fa2d17afce6c6602709aac8b19d35113375b9f5d1fb3697e77b194a95a175fac07eddba7c6477a671ac402f5283fecc76961cab56447d32
SSDEEP

49152:Qoa1taC070d6WRWv1oYVvjGPAqKJjiwDT2:Qoa1taC0lWRQoEbGPAb5a

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes itself 1 IoCs

Processes:

5534.tmp

pid process

2396 5534.tmp
Executes dropped EXE 1 IoCs

Processes:

5534.tmp

pid process

2396 5534.tmp

pid	process
2396	5534.tmp

pid	process
2396	5534.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

750cb749a845c19ce711fa7ab6c70c2f.exe

description	pid	process	target process
PID 3668 wrote to memory of 2396	3668	750cb749a845c19ce711fa7ab6c70c2f.exe	5534.tmp
PID 3668 wrote to memory of 2396	3668	750cb749a845c19ce711fa7ab6c70c2f.exe	5534.tmp
PID 3668 wrote to memory of 2396	3668	750cb749a845c19ce711fa7ab6c70c2f.exe	5534.tmp

C:\Users\Admin\AppData\Local\Temp\750cb749a845c19ce711fa7ab6c70c2f.exe
"C:\Users\Admin\AppData\Local\Temp\750cb749a845c19ce711fa7ab6c70c2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Users\Admin\AppData\Local\Temp\5534.tmp
Filesize
192KB

MD5
17cfbfff2c891bdc3088042ad440f1d4

SHA1
85ca72e88ccac8a609afbde9178f025e92428da4

SHA256
99279e1fde59b255ee6e4633a6d1b98ee2e447e319edc77f62874110f041645c

SHA512
d9676d032f8d697930f1c512ffde3bfb4427022a8eec11e04c9b24b30eeda059158a5d566e7c116e0e670fc113983afde6da525f0b19f1e1c1e73b5fef4b332a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5534.tmp
Filesize
47KB

MD5
c916a0ce3fe39e5926625281ce423f00

SHA1
42339d491c7779f2baee888f2b0a48a84a4955a0

SHA256
212c8823093c34c9f385035b300f2405e6df13e5308633ed167f19bc8e368e4d

SHA512
24f04a6d9f0ab8000c1b471f59ce1434857bdc2ca524d39c2c87ce8128848d9bd678e6e3650477d6dc9f2f08b39db92e8df33de4e185b0e8844fa4f38070d153

Download Submit
memory/2396-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3668-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download