Analysis
-
max time kernel
132s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:25
General
-
Target
75162acd3500bbf916f427927dc21b33.exe
-
Size
2.9MB
-
MD5
75162acd3500bbf916f427927dc21b33
-
SHA1
657dc4e1b8eceba7c254edfe5c76a702a05a3eae
-
SHA256
dc2843dc3529f43324be0b38e979942942a77069473b6a3ddefb0e5be1d267ae
-
SHA512
32e65816e93f7ed08b935fbcbe53fb4ebda957038319008f6018aadbcf01ec813877f806965c732624ee2988c43c4e66980c675733494496135a386dde08987a
-
SSDEEP
49152:pruzZm03Dw3sRCgjq/FuapgWHz8kQ239t/rP4M338dB2IBlGuuDVUsdxxjeQZwxs:p2Q03888gW/FXpR5Rgg3gnl/IVUs1jek
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75162acd3500bbf916f427927dc21b33.exe"C:\Users\Admin\AppData\Local\Temp\75162acd3500bbf916f427927dc21b33.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75162acd3500bbf916f427927dc21b33.exeC:\Users\Admin\AppData\Local\Temp\75162acd3500bbf916f427927dc21b33.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5f26c8d9f8fae61fee7ba97252942728d
SHA18b55ef10dcf82ebf9d3821dca7b87453cbc35269
SHA2566f319eb6cc39862b04b3c924ed3b9bf81ce3a0b8e9b666f5013b451ee81ed8b5
SHA512fed28f4cfb9a819061b82f21d9e8031c8b8f3ade4fc4c876278202b80371bdbf21ccae91dcfad2745f81f4868c96935a858f31140bdcf825e7c4b0ff898fa55a
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB