Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    1.2MB

  • MD5

    e86ccc9eb8589e4a26563a44bcea7910

  • SHA1

    929ed775761c5f3433050a81ee5608f07edffd83

  • SHA256

    1f6999f1383c952c4f6ed3b69bb8485535839c2b60eb425642ef2548b94caae4

  • SHA512

    a00b520483848203cae540c557952965d4c22279a947a85c462905b94e3e7d02b72b7e5c9566d1e0e3660375bddd45effb3f1e0ba4bb1b329ed1a1e4b04c09ef

  • SSDEEP

    24576:eneDJWBtx+S0BPkWTmD1e1tJdK+iUdEwQqsiK3C7SyhqNkLxvUo+x:ene1Sx+RPkWSD1e1tgDlX3C+tNkVMo+

Score
10/10
kinsingriseproloaderstealer

Malware Config

Extracted

Family

risepro

C2

193.233.132.62:50500

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1512-0-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-2-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-3-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-4-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-5-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-6-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-7-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-8-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-9-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-10-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-11-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-12-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-13-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-14-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1512-15-0x0000000000A00000-0x0000000000EE3000-memory.dmp
    Filesize

    4.9MB

    Download