kinsing | hxxps://cloudflare-ipfs[.]com/ipfs/bafybeig4sgehvrm2hqktz6i7i3ronjzbxsm7zn3rzbthb6sbpmjg2vakti/#aurelien[.]velez@seacargo[.]com

General

Target

https://cloudflare-ipfs.com/ipfs/bafybeig4sgehvrm2hqktz6i7i3ronjzbxsm7zn3rzbthb6sbpmjg2vakti/#[email protected]

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 cloudflare-ipfs.com
7 cloudflare-ipfs.com

flow	ioc
5	cloudflare-ipfs.com
7	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506766787526090"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

536 chrome.exe
536 chrome.exe
5184 chrome.exe
5184 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

536 chrome.exe
536 chrome.exe
536 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 536 wrote to memory of 2304	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2304	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2340	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2596	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 2596	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe
PID 536 wrote to memory of 5408	536	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloudflare-ipfs.com/ipfs/bafybeig4sgehvrm2hqktz6i7i3ronjzbxsm7zn3rzbthb6sbpmjg2vakti/#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe057d9758,0x7ffe057d9768,0x7ffe057d9778
2⤵
PID:2304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:2
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:8
2⤵
PID:5408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:1
2⤵
PID:4176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:1
2⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:8
2⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4964 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:1
2⤵
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:8
2⤵
PID:4792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:8
2⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 --field-trial-handle=1884,i,6389768778357300007,12088462473241151788,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
3979a6a16a68a7b67ca6f538ded4dab2

SHA1
94a22307c4e97ff424d82e2de7801e7ab0c69e20

SHA256
423fb6ebaf08d5e96febd50d7fb15f16b052b6272bf694ea43e2bfb3d7b6d06c

SHA512
ad790f06f672b85d067a3268e0f6eda74b349a1c7c4fe47fcbac72a7d9667432c7be1ee12806e516a23292cdf96a119b349fdaaa9ef88ff948370a49d890dabe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
0f11e98917af621091240219aabd3fbf

SHA1
d2f7183e3816efafe55c2c3d56424528b3ab9ec4

SHA256
cc9e6b9560fd08c52bb90ae7b47e6819e760b198f4c6deb1a4416d96b2ad56f8

SHA512
fd4c6bbbec9ac611f9957fb1a6378dd44901477c54d71a33d36753c69dcf5bdbd631984dad8cb98fbc10b3b1e4dc8834d9067525fe959a9e602c0946725b5ac8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
d79687c956a69ab24ecc10f4a970eb1c

SHA1
2d4e1bdd94dd5a190c443c45b871db385bf3bab7

SHA256
54aecfa06c939e68141e00bf22660d804d382077c22e61b01a25d914950f96e7

SHA512
2de75d20591080056f0ffe351a689e31dfe766748e30532f4cebcefc0a8d64a4be4b8d71a7f3c965c03ba1d5e4dd818b6cd7fafed246bb064d23c8bbb0883af5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f891f351fa392f2d4895f8f606496b8f

SHA1
96ce6a9b0278f2d5eb15e98bd685c2cff80db855

SHA256
59f3d48511c0d6e55c53fdbbe457a7738e9dc5ddd7285e5453a97590af05f86c

SHA512
7cbcc3b459abe91ffc9bf9d0c7d93c45a396f478774728fd872f0dcc71d1159d728671184e2fe6fab0961d6e35ef1c7ebeeb66b4219a5391bf583a4354197c36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
114KB

MD5
5447b77357103b73d90a60419db1eb07

SHA1
6fdc8ead5099c018071cd48447466926097830a3

SHA256
36f635f3548c06c75aee4645be73efacd7f02aaa8a728285c7a16eca14ba394a

SHA512
58e52418f8b17251c0c119c238d528022fcc5f10fe10ad0a903f3a7c47240678adbd84ab41fe921f63c7dff2b19c196be0d9fc97cdac0ed278fd88990c1baffc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_536_IEMMRDOVSGRORKZA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads