kinsing | 34c68cb89e2052b9d6a4b453b61fb1d24a347212d35478a92277317603924d5e

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7511b6aa64c28678203a59305da554f9.exe
Size

628KB
MD5

7511b6aa64c28678203a59305da554f9
SHA1

75644207828d02689738034e6eb084cf797bdf6f
SHA256

34c68cb89e2052b9d6a4b453b61fb1d24a347212d35478a92277317603924d5e
SHA512

e6bea935bb933f306d7a6bb76c2748f0586c33c54ad74ed0bc480f468610d98176ebc120af8ecedd8702d11e1eece4e9c75991e56a7ea8a6b4b9726c55b127d9
SSDEEP

12288:pUaHSIUvBl7H6xDYY7WZrpiB1+F3Z4mxx64IxSo62jDrkAwha:6aHSIGB96xsY78pif+QmXqsohkDM

Score

10^/10

kinsing modiloader loader trojan

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1400-94-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2
behavioral2/memory/1400-104-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7511b6aa64c28678203a59305da554f9.exe

description	ioc	process
File opened (read-only)	\??\S:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\X:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\Y:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\A:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\G:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\H:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\M:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\P:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\U:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\Z:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\B:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\I:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\N:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\O:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\T:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\W:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\E:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\K:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\L:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\Q:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\J:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\R:	7511b6aa64c28678203a59305da554f9.exe
File opened (read-only)	\??\V:	7511b6aa64c28678203a59305da554f9.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

7511b6aa64c28678203a59305da554f9.exe

description	ioc	process
File opened for modification	C:\AutoRun.inf	7511b6aa64c28678203a59305da554f9.exe
File opened for modification	F:\AutoRun.inf	7511b6aa64c28678203a59305da554f9.exe

Drops file in Program Files directory 1 IoCs

Processes:

7511b6aa64c28678203a59305da554f9.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt 7511b6aa64c28678203a59305da554f9.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4248 1400 WerFault.exe 7511b6aa64c28678203a59305da554f9.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt	7511b6aa64c28678203a59305da554f9.exe

pid	pid_target	process	target process
4248	1400	WerFault.exe	7511b6aa64c28678203a59305da554f9.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

7511b6aa64c28678203a59305da554f9.exe

description	pid	process	target process
PID 1400 wrote to memory of 3264	1400	7511b6aa64c28678203a59305da554f9.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 3264	1400	7511b6aa64c28678203a59305da554f9.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\7511b6aa64c28678203a59305da554f9.exe
"C:\Users\Admin\AppData\Local\Temp\7511b6aa64c28678203a59305da554f9.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1400

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 684
2⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1400 -ip 1400
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AutoRun.inf
Filesize
157B

MD5
d27451cf32abe7a48f20a44c1d240777

SHA1
ebe8640298f71d3d7191ea7e7dbf618c4f620d08

SHA256
e62b737c2867f81414ff038e3d1ca72a14d77fba22b8f0cb0575e50262eb5568

SHA512
1df9eb1cf7d91e2ffc7826af910b26e710d510bc0dbeee85832a43ea3b9da034c905aa24d70fb7311fdee44a9e5b4ff97000ca708de89c9f5354dbf137d73101

Download Submit
memory/1400-50-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/1400-14-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/1400-4-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1400-3-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1400-5-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1400-6-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1400-7-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1400-8-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1400-9-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/1400-11-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/1400-10-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1400-13-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download
memory/1400-12-0x0000000003500000-0x0000000003503000-memory.dmp

Filesize
12KB

Download
memory/1400-52-0x0000000003610000-0x0000000003611000-memory.dmp

Filesize
4KB

Download
memory/1400-17-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/1400-1-0x0000000000B80000-0x0000000000BD4000-memory.dmp

Filesize
336KB

Download
memory/1400-26-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1400-36-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/1400-15-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1400-38-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1400-39-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1400-40-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1400-41-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/1400-42-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/1400-43-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/1400-44-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/1400-45-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/1400-46-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/1400-47-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1400-48-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/1400-54-0x0000000003720000-0x0000000003721000-memory.dmp

Filesize
4KB

Download
memory/1400-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1400-55-0x0000000003750000-0x0000000003751000-memory.dmp

Filesize
4KB

Download
memory/1400-2-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1400-49-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/1400-53-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/1400-56-0x0000000003740000-0x0000000003741000-memory.dmp

Filesize
4KB

Download
memory/1400-51-0x00000000035E0000-0x00000000035E1000-memory.dmp

Filesize
4KB

Download
memory/1400-57-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/1400-59-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/1400-58-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/1400-60-0x0000000003790000-0x0000000003791000-memory.dmp

Filesize
4KB

Download
memory/1400-61-0x00000000037C0000-0x00000000037C1000-memory.dmp

Filesize
4KB

Download
memory/1400-62-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/1400-63-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/1400-64-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/1400-65-0x0000000003920000-0x0000000003921000-memory.dmp

Filesize
4KB

Download
memory/1400-66-0x0000000003950000-0x0000000003951000-memory.dmp

Filesize
4KB

Download
memory/1400-67-0x0000000003980000-0x0000000003981000-memory.dmp

Filesize
4KB

Download
memory/1400-68-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/1400-71-0x00000000039E0000-0x00000000039E1000-memory.dmp

Filesize
4KB

Download
memory/1400-70-0x00000000039C0000-0x00000000039C1000-memory.dmp

Filesize
4KB

Download
memory/1400-69-0x00000000039D0000-0x00000000039D1000-memory.dmp

Filesize
4KB

Download
memory/1400-72-0x0000000003A10000-0x0000000003A11000-memory.dmp

Filesize
4KB

Download
memory/1400-73-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/1400-74-0x0000000003A20000-0x0000000003A21000-memory.dmp

Filesize
4KB

Download
memory/1400-75-0x0000000003A40000-0x0000000003A41000-memory.dmp

Filesize
4KB

Download
memory/1400-76-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/1400-78-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Filesize
4KB

Download
memory/1400-77-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download
memory/1400-79-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1400-80-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

Filesize
4KB

Download
memory/1400-81-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/1400-82-0x0000000003C10000-0x0000000003C11000-memory.dmp

Filesize
4KB

Download
memory/1400-94-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1400-104-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download