kinsing | 54e7b2237d323a445de3206c1c9a43a41c766374139db71bd72e273f7b8f87f6 | Triage

Analysis

max time kernel
90s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:24

Sharing

Report Analysis Logs

General

Target

75157952e643732889c978b8e05382c2.dll
Size

52KB
MD5

75157952e643732889c978b8e05382c2
SHA1

7a6cb3af1a19df54e52f788e443b446854b368d4
SHA256

54e7b2237d323a445de3206c1c9a43a41c766374139db71bd72e273f7b8f87f6
SHA512

32feacf828ba596e044d3f38a39aac856f817056289de95003996b558fafc425ce5f78637a277103e6db74182df035a2ee3ececda5059541eb0d954b59da35bb
SSDEEP

768:wIDLrjeTKJuIC+lxyoUCkNVN4SDyIwG7Hs:wIDLrjyKJuvoUBKSfwG7Hs

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 808	2304	regsvr32.exe	21
PID 2304 wrote to memory of 808	2304	regsvr32.exe	21
PID 2304 wrote to memory of 808	2304	regsvr32.exe	21

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75157952e643732889c978b8e05382c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\75157952e643732889c978b8e05382c2.dll
  2⤵
  PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads