kinsing | e7f9d2289f5f0e81debf0639230085e5452434c65d099282b74c814728b02929

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:11

Target

750ea151345b5ace88676aa29618cf60.exe
Size

780KB
MD5

750ea151345b5ace88676aa29618cf60
SHA1

1e58b32c3e4d2be50c804e3e8981d65a462e60d3
SHA256

e7f9d2289f5f0e81debf0639230085e5452434c65d099282b74c814728b02929
SHA512

1057e3313d24d7d3ba8b69993ff9f64f28fa150efc18b4e99808f48a897b0e7ca7b0e537d4acfb480a2e5f6458560fba55b997e861128e2bf03fa81a79a18bc4
SSDEEP

12288:pSS+fzj2IsqLKBiMv6vHLfnQTsFy+XzlsxJm:pSSCXzkiMvwrPQTZ6zA

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

750ea151345b5ace88676aa29618cf60.exe

C:\Users\Admin\AppData\Local\Temp\750ea151345b5ace88676aa29618cf60.exe
"C:\Users\Admin\AppData\Local\Temp\750ea151345b5ace88676aa29618cf60.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1368

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact