kinsing | d77a562b77b147616b6ebe245fe2ca92bee22da4f13d92be731bf5262842738e

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
750ec45944d77c6e8967fd1c3e3bf188.exe
Size 197KB
Sample240125-vqn4labdb2
SHA256 d77a562b77b147616b6ebe245fe2ca92bee22da4f13d92be731bf5262842738e
MD5 750ec45944d77c6e8967fd1c3e3bf188
SHA1 eb6afdd3c7236e7ca5d0016c2f51b02f7d4403a2
SHA512 8f435ef2d6a79e6322784591000d96ec9c464d61bc520bc1e5ac216e9ae24d9bc4bd2b4b624f3fe36615ff1ed8696c702fce31830994ceab4adaf8e0da626e43
SSDEEP 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B87pjIkgnq:o68i3odBiTl2+TCU/WIk8q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader persistence

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	750ec45944d77c6e8967fd1c3e3bf188.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exez	750ec45944d77c6e8967fd1c3e3bf188.exe
File opened for modification	C:\Windows\winhash_up.exez	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\winhash_up.exe	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	750ec45944d77c6e8967fd1c3e3bf188.exe
File created	C:\Windows\bugMAKER.bat	750ec45944d77c6e8967fd1c3e3bf188.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4696	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4696	3804	750ec45944d77c6e8967fd1c3e3bf188.exe	85
PID 3804 wrote to memory of 4696	3804	750ec45944d77c6e8967fd1c3e3bf188.exe	85
PID 3804 wrote to memory of 4696	3804	750ec45944d77c6e8967fd1c3e3bf188.exe	85

C:\Users\Admin\AppData\Local\Temp\750ec45944d77c6e8967fd1c3e3bf188.exe
"C:\Users\Admin\AppData\Local\Temp\750ec45944d77c6e8967fd1c3e3bf188.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bugMAKER.bat

Path C:\Windows\bugMAKER.bat
Size 76B
SHA256 69d975bf2b33ac2fe381a8ab25073218d1de7d560e17b4d785930b9efac21a3e
MD5 11a3dc9004e11ca2ecbad46cb0ea392d
SHA1 24a3ce616e15875cef31ccd2dbc93a5d6c627e26
SHA512 2ecd2f42e2f0bbcbece17c475db469f65f3a7cb006b916ba7de75508c013611f34b9119aad4db8ddc992857fbd1d0fc76a6aa6162916c67013ce060442891821
MD5 SHA1 SHA512

Submit Download

memory/3804-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads