Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/01/2024, 17:23
General
-
Target
2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe
-
Size
55KB
-
MD5
19ef5f2c0b668b9898458c3c18eb1571
-
SHA1
1ad4fb5fa4a07375b566155ec38cf2c8265ec939
-
SHA256
f4c5c530a31fcd80540778349c53b1487a03ef4a828d5f6a7b9e19b32122f7bb
-
SHA512
9bfd38c98ed23885b0ec788f7258ad7ade967c6feccf48c7884749757198a5a77d37a52f5223a7919a7514dad38689fcf312751e1e3bef4c69a9c29448b5fb39
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3VylsPxAy:79mqyNhQMOtEvwDpjBPY7xv3gy5Z
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Detection of CryptoLocker Variants 3 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD55354c366a6c4696166abbce80f44f5b4
SHA1d4f4138c85db4f0d2bfd6c47271e220350730ff0
SHA256d94e048d1a46878cda5f007a6006ed9c05ca46708db4aa1379a38ec77d5ae205
SHA512cb8d6d4ce31287c549b442d1cf1aec68c0f93cdc16ff29bf2721ed1606ea169a52b6f8a70fc4523a2b6849996bdd452b32437012b91aa8f9bd774f9de2927f4a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB