kinsing | e25a6d9b29dee20ca40f8b4bfbf591a775bc6cb4902f8991928e41fcfad4bd65 | Triage

Resubmissions

29/08/2024, 00:34

240829-aw9bhavbrc 7

08/08/2024, 20:23

240808-y6jetsygmm 7

25/01/2024, 17:21

240125-vxdw7scdfm 10

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:21

Sharing

Report Analysis Logs

General

Target

kcheck2.dll
Size

30KB
MD5

3b1ffbe4744eefcaa7285eb4e700dca2
SHA1

6319e6863a3c980d94818daa1040f93e3e1be8d8
SHA256

fcff934d640972756710d86d55df19449dc90c58563e053d5b42ab4ac8dd30f0
SHA512

6d034b95f1324a51ccf5ad8145ebf79857c5d4a953e7ccfcf98fe7fc0adb11a1747205c14779df4051988dd0168a8bdf864eb511f6e3a349831af25fffdb0129
SSDEEP

192:ZuBd9yGkN2j9RhAEvryowJL/KxO4SLvYihx3aQe0HG0:G97Yi9R6yrYJLiOLLvYiDm0m0

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4196	1428	rundll32.exe	85
PID 1428 wrote to memory of 4196	1428	rundll32.exe	85
PID 1428 wrote to memory of 4196	1428	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kcheck2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\kcheck2.dll,#1
  2⤵
  PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads