Analysis
-
max time kernel
89s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:21
General
-
Target
751466fc245a3eadaa224a87b6049524.exe
-
Size
1.3MB
-
MD5
751466fc245a3eadaa224a87b6049524
-
SHA1
bb68981df4b05a4377f3f95062905a9397effff9
-
SHA256
86fe5525454ebabf6fd3c8510268c7ccd07c466d22dc5b0a8c45436f02a65cbe
-
SHA512
7121ef1992ac4227e1c09a65e154a61df5a9e69e33a02a2a4b850629e809abdab3f97a9c8fcd13cf66706fc7d17d291fbd2a9ad8427c481acc424e4bb35cd9ea
-
SSDEEP
24576:6XhkaxjVFgpezYBxpBhhw9swR5/AjJM7c/iky4/mrg0EROPFXL2IXjaTRyUW7Wc:6Xhk6Fgp4YTpFwKDJM7c/M4qgZ8F7HOu
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\751466fc245a3eadaa224a87b6049524.exe"C:\Users\Admin\AppData\Local\Temp\751466fc245a3eadaa224a87b6049524.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\751466fc245a3eadaa224a87b6049524.exeC:\Users\Admin\AppData\Local\Temp\751466fc245a3eadaa224a87b6049524.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
530KB
MD54205b482a491ed20386b0092e1e57af3
SHA1af17467da96e490d48435b023345c9065980b9bc
SHA256c9abcccfb7a495e7ddfc8f0f88549f703d102d1c5053d60e9006990c77257660
SHA5124b4bf29a07f7c9b23c79e77ca300baba8f3f8e69db4e6a8e9600c157348d703232ff2b39fc1feb7e896b1281141bc7c4b832adcd0bc84d413ae48de9f3b53061
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB