kinsing | 9cf83f6abcd1b64e9fdbc91943b4bb70849c4be043655758bdc9298a5cdb94f0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe
Size 168KB
Sample240125-vyw46sbeh5
SHA256 9cf83f6abcd1b64e9fdbc91943b4bb70849c4be043655758bdc9298a5cdb94f0
MD5 23d956efe4d370a655d67f021e806060
SHA1 3b42abab093eb5fa5eac1c470ef32ec236361798
SHA512 7cd240a6c9d5432ac31db6ba729057602733aef23460aa30243953a30894853b670b67f0325af2d402e9b46c646ded392e3d2dd382b8f5bf8dc99baac5ee57b0
SSDEEP 1536:1EGh0oQlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oQlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader persistence

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023217-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023220-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023227-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023220-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c0000000217f9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000021805-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000217f9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d0000000217f9-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006e1-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24160113-E9FF-4279-995A-AB52FA291E4E}\stubpath = "C:\\Windows\\{24160113-E9FF-4279-995A-AB52FA291E4E}.exe"	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}\stubpath = "C:\\Windows\\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe"	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DB2837E-1234-4314-955B-4EA46A172368}	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}\stubpath = "C:\\Windows\\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe"	{1DB2837E-1234-4314-955B-4EA46A172368}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4053B40-A119-4858-AB3B-A954FBBF36BA}	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}\stubpath = "C:\\Windows\\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe"	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DB2837E-1234-4314-955B-4EA46A172368}\stubpath = "C:\\Windows\\{1DB2837E-1234-4314-955B-4EA46A172368}.exe"	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BAFEF36-B398-4208-917C-2565A5D3A477}\stubpath = "C:\\Windows\\{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe"	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}\stubpath = "C:\\Windows\\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe"	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0132335E-18FC-4398-9848-D27AD5181EA0}	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0132335E-18FC-4398-9848-D27AD5181EA0}\stubpath = "C:\\Windows\\{0132335E-18FC-4398-9848-D27AD5181EA0}.exe"	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4053B40-A119-4858-AB3B-A954FBBF36BA}\stubpath = "C:\\Windows\\{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe"	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}\stubpath = "C:\\Windows\\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe"	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A33B487-B7B4-490e-9BB8-FE01925CB256}	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A33B487-B7B4-490e-9BB8-FE01925CB256}\stubpath = "C:\\Windows\\{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe"	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BAFEF36-B398-4208-917C-2565A5D3A477}	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24160113-E9FF-4279-995A-AB52FA291E4E}	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}\stubpath = "C:\\Windows\\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe"	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}	{1DB2837E-1234-4314-955B-4EA46A172368}.exe

Executes dropped EXE 12 IoCs

pid	Process
4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
1908	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
652	{1DB2837E-1234-4314-955B-4EA46A172368}.exe
1996	{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
File created	C:\Windows\{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
File created	C:\Windows\{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
File created	C:\Windows\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
File created	C:\Windows\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
File created	C:\Windows\{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
File created	C:\Windows\{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe
File created	C:\Windows\{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
File created	C:\Windows\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
File created	C:\Windows\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
File created	C:\Windows\{1DB2837E-1234-4314-955B-4EA46A172368}.exe	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
File created	C:\Windows\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe	{1DB2837E-1234-4314-955B-4EA46A172368}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
Token: SeIncBasePriorityPrivilege	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
Token: SeIncBasePriorityPrivilege	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
Token: SeIncBasePriorityPrivilege	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
Token: SeIncBasePriorityPrivilege	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
Token: SeIncBasePriorityPrivilege	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
Token: SeIncBasePriorityPrivilege	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
Token: SeIncBasePriorityPrivilege	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
Token: SeIncBasePriorityPrivilege	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
Token: SeIncBasePriorityPrivilege	1908	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
Token: SeIncBasePriorityPrivilege	652	{1DB2837E-1234-4314-955B-4EA46A172368}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4664	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe	96
PID 1560 wrote to memory of 4664	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe	96
PID 1560 wrote to memory of 4664	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe	96
PID 1560 wrote to memory of 2660	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe	97
PID 1560 wrote to memory of 2660	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe	97
PID 1560 wrote to memory of 2660	1560	2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe	97
PID 4664 wrote to memory of 2016	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	98
PID 4664 wrote to memory of 2016	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	98
PID 4664 wrote to memory of 2016	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	98
PID 4664 wrote to memory of 3164	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	99
PID 4664 wrote to memory of 3164	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	99
PID 4664 wrote to memory of 3164	4664	{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe	99
PID 2016 wrote to memory of 4200	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	102
PID 2016 wrote to memory of 4200	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	102
PID 2016 wrote to memory of 4200	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	102
PID 2016 wrote to memory of 4508	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	101
PID 2016 wrote to memory of 4508	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	101
PID 2016 wrote to memory of 4508	2016	{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe	101
PID 4200 wrote to memory of 2512	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	103
PID 4200 wrote to memory of 2512	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	103
PID 4200 wrote to memory of 2512	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	103
PID 4200 wrote to memory of 1344	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	104
PID 4200 wrote to memory of 1344	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	104
PID 4200 wrote to memory of 1344	4200	{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe	104
PID 2512 wrote to memory of 4912	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	105
PID 2512 wrote to memory of 4912	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	105
PID 2512 wrote to memory of 4912	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	105
PID 2512 wrote to memory of 3748	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	106
PID 2512 wrote to memory of 3748	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	106
PID 2512 wrote to memory of 3748	2512	{0132335E-18FC-4398-9848-D27AD5181EA0}.exe	106
PID 4912 wrote to memory of 4460	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	107
PID 4912 wrote to memory of 4460	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	107
PID 4912 wrote to memory of 4460	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	107
PID 4912 wrote to memory of 4536	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	108
PID 4912 wrote to memory of 4536	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	108
PID 4912 wrote to memory of 4536	4912	{24160113-E9FF-4279-995A-AB52FA291E4E}.exe	108
PID 4460 wrote to memory of 5116	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	109
PID 4460 wrote to memory of 5116	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	109
PID 4460 wrote to memory of 5116	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	109
PID 4460 wrote to memory of 2120	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	110
PID 4460 wrote to memory of 2120	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	110
PID 4460 wrote to memory of 2120	4460	{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe	110
PID 5116 wrote to memory of 2560	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	111
PID 5116 wrote to memory of 2560	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	111
PID 5116 wrote to memory of 2560	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	111
PID 5116 wrote to memory of 2396	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	112
PID 5116 wrote to memory of 2396	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	112
PID 5116 wrote to memory of 2396	5116	{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe	112
PID 2560 wrote to memory of 4352	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	113
PID 2560 wrote to memory of 4352	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	113
PID 2560 wrote to memory of 4352	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	113
PID 2560 wrote to memory of 3388	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	114
PID 2560 wrote to memory of 3388	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	114
PID 2560 wrote to memory of 3388	2560	{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe	114
PID 4352 wrote to memory of 1908	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	115
PID 4352 wrote to memory of 1908	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	115
PID 4352 wrote to memory of 1908	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	115
PID 4352 wrote to memory of 4848	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	116
PID 4352 wrote to memory of 4848	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	116
PID 4352 wrote to memory of 4848	4352	{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe	116
PID 1908 wrote to memory of 652	1908	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe	118
PID 1908 wrote to memory of 652	1908	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe	118
PID 1908 wrote to memory of 652	1908	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe	118
PID 1908 wrote to memory of 4464	1908	{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe	117

C:\Users\Admin\AppData\Local\Temp\2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_23d956efe4d370a655d67f021e806060_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
  C:\Windows\{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
    C:\Windows\{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2BAFE~1.EXE > nul
      4⤵
      PID:4508
  - - C:\Windows\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
      C:\Windows\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
        
        C:\Windows\{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
      - C:\Windows\{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
        
        C:\Windows\{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
        
        C:\Windows\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
        
        C:\Windows\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
        
        C:\Windows\{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
        
        C:\Windows\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
        
        C:\Windows\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C2F53~1.EXE > nul
        12⤵
        
        PID:4464
        
        C:\Windows\{1DB2837E-1234-4314-955B-4EA46A172368}.exe
        
        C:\Windows\{1DB2837E-1234-4314-955B-4EA46A172368}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:652
        
        C:\Windows\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe
        
        C:\Windows\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe
        13⤵
        Executes dropped EXE
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1DB28~1.EXE > nul
        13⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4AE20~1.EXE > nul
        11⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A4053~1.EXE > nul
        10⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30BE6~1.EXE > nul
        9⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DABE5~1.EXE > nul
        8⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24160~1.EXE > nul
        7⤵
        
        PID:4536
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{01323~1.EXE > nul
        6⤵
        
        PID:3748
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E5BF~1.EXE > nul
        5⤵
        
        PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8A33B~1.EXE > nul
    3⤵
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0132335E-18FC-4398-9848-D27AD5181EA0}.exe

Path C:\Windows\{0132335E-18FC-4398-9848-D27AD5181EA0}.exe
Size 168KB
SHA256 ad8eee1de61b82e1a99ffd14d0727bc65d1c7c44d753cd43347e3644fa03dfc9
MD5 12fed7d8f8973591097d76dc931e9a25
SHA1 ebade524c4c382b297b391c7e93d9d0a26f473e0
SHA512 9664933bc968f5e6c3c8d5276b5b3c0c62f25a7df68218aac20250680f95bc7ed0f3794e438de7d54eeb568ddb2bf8d0deba27e5825b3e8af77e233fbe7fce31
SSDEEP 1536:1EGh0ojlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ojlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe

Path C:\Windows\{10E6FD8C-62F7-460f-821B-04E9AD46C3C6}.exe
Size 168KB
SHA256 6cdbaa42ab32af80fd7719d68130272e837f53e7063be8030926d5709f8c6496
MD5 866d5eca1a1bd5aa3f7433ecd02ba848
SHA1 3e618d9b260221fffdfa6a38d310c881b240753e
SHA512 9a7a3ecec5d1661ee81348834e3271381e6cbea560a17cdcc6cad09195a94fcd972a954e19e22a9c467868ae1473d45cd79216cb67ca0b7c7df9b48d53053af7
SSDEEP 1536:1EGh0owlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0owlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1DB2837E-1234-4314-955B-4EA46A172368}.exe

Path C:\Windows\{1DB2837E-1234-4314-955B-4EA46A172368}.exe
Size 168KB
SHA256 b158be3b9370800b59a6894cf8712e758639427fbce94bca3de2a37b123e0236
MD5 2f15df8676c821e4ae2135e73133b893
SHA1 26be9e739259c7e66f5d138466a9fdc9e25ba400
SHA512 8ef334dfb6149c5027199cd3695d577ffbc88ddcd6857d6ed7ed48ed0c0a18cf0afa5d766d7af7279292a95a379a47a25290aad2ecaec9f0a265ddb567b334d8
SSDEEP 1536:1EGh0oAlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oAlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{24160113-E9FF-4279-995A-AB52FA291E4E}.exe

Path C:\Windows\{24160113-E9FF-4279-995A-AB52FA291E4E}.exe
Size 168KB
SHA256 215932652e1bc2ed539d12857e018e2b814dc16e28d8fe6493184dcdc2a71ef6
MD5 161e70043190d5f6d8c5efe93c5f6e0b
SHA1 7aaa5f8043bb2fcfe7a57aa390fbb3635772c200
SHA512 7587ab62bc8cd9ad82a6c6043e5efd7a39565ae35399de512b74dffab7b415bd0733791e0c17c0dd155c9aa00be83c1885e1566f64070085488845e4f5b37ebf
SSDEEP 1536:1EGh0oGlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oGlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe

Path C:\Windows\{2BAFEF36-B398-4208-917C-2565A5D3A477}.exe
Size 168KB
SHA256 fed450e3c481200c4a92f0fe193f0952ee08437ce16edcf8b472814b72b14ef7
MD5 183490f4d7d76203505e6116c2357872
SHA1 5e1dd128410647b3682abcb933a035a2102a0272
SHA512 6cc3f1e613b0ef2575a1d8cef6539b372dd4c81d73d699153ca2a41592008f6c3e2f5515b014f11f01ebfd9ec3cdcda9819277ede9724762fadda51c5dfcf944
SSDEEP 1536:1EGh0oglq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oglqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe

Path C:\Windows\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
Size 58KB
SHA256 936a54cf3ebcf87771dfca765fee15048c22e4bc639abc57105acc6c9865b9cd
MD5 8ffc25b1581b03cf6a222d08f414b62d
SHA1 e50fe8e8d415ce618701930c566f8fd0e25ccc28
SHA512 9d8707766bfa9bb4bf6f3ee31eaa28a86251ac9f2ec43a46fae4bc9e9ed3cf9bb60f1da88868206dba5d34a8e1155fab4340b6a1b7637f003c329dd32a13c653
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwH74/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroH74/CFsrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe

Path C:\Windows\{30BE6B2E-7402-4b61-B42B-4DE8C63A5602}.exe
Size 168KB
SHA256 9f9643b71dd6a40a77952b9989902b1cc1bd053fcf699bae0744284dd7a87366
MD5 2c6908c614d540464f7308cd4d0a6d1e
SHA1 b9a78f5633b0adc3bdec20bb92b351122dc340a1
SHA512 3267567eb3c48ad67d75e34a2a626b02609ff13f23098c4c6a76f9d9c693f53306604be7ba975aaa0867a893d63b1a64ff7b419ef544f2b6a38f8422a9aed188
SSDEEP 1536:1EGh0oblq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oblqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe

Path C:\Windows\{4AE201AA-A23D-4bba-A710-E95A8CDBEB52}.exe
Size 168KB
SHA256 b4da280a3f93b6f589f13e52dc72348690d3963596c25810bf5cc6ae76e49a5e
MD5 023f4612dc8da985d926d31eb33a1b76
SHA1 ce4145abdea6f1686c29896cbeb956985b0caa24
SHA512 ab9fb631745e2947f741f6c48a636759847818bd99c28e70d32272eefb102e1249121ce744e631034455ebfed2e29ba589dc5439490308a5cd55ecaec12f6e89
SSDEEP 1536:1EGh0oBlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oBlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe

Path C:\Windows\{8A33B487-B7B4-490e-9BB8-FE01925CB256}.exe
Size 168KB
SHA256 8e3ea04b644d4fc9e4f8d07cd27e17584c31d303c07ac84b2314282172bfdb1e
MD5 659c694a7353735bba5a094810ec0b81
SHA1 36e58a82e56d7efb316b3e5b46c4a23dd9d1e1e8
SHA512 c156e008973757b4a6aa778f81d45cde041d16af0a12a61b10c076b5872e5d4662590e696c227a9569d5e47ea193cd3bd0c212493793dc7881fd84002b0b0a60
SSDEEP 1536:1EGh0oPlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oPlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe

Path C:\Windows\{9E5BF0ED-3CF1-4eca-9DE7-B25687350283}.exe
Size 168KB
SHA256 b6b0c783dd91d8e081f817343380c56395e6edbe7cd1c3c5cc42f38f92388f81
MD5 3ba644379bdc7f1c716ee799a71499c5
SHA1 9eae0678183c5c8028fc65c5956899167d996608
SHA512 bfe870bd53e15c0f83645b73799d7cb0ca9a8904b2e26930f03f2e856cac3c3db549a8bcdff2e141653026b2152d8ae69bc16c3e71038af5976791a170670fb1
SSDEEP 1536:1EGh0otlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0otlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe

Path C:\Windows\{A4053B40-A119-4858-AB3B-A954FBBF36BA}.exe
Size 168KB
SHA256 97a94c2ea48235500066590b2e58fc87ad37636ea7209b33d1e0c343797d1501
MD5 4cb202672766298aafa85b2c2eb96e30
SHA1 a6672c497527d91ae27388895d83bb60bd879619
SHA512 2236d1b0150f201129d3ed3716bd57548852dd8618e3431ad34f0052ff3ac26157696b3197112f98d925d9e54cb36951bb17f704f596a1ac73fe5b7cf271ed76
SSDEEP 1536:1EGh0o6lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o6lqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe

Path C:\Windows\{C2F539CC-5C32-4a2d-85C2-532C05EBFABF}.exe
Size 168KB
SHA256 3ecf811588467015edcc390777bf10e790e60ac73640fb0cdcd17baa4d1954e8
MD5 4028f8f717ae306788036e893551cf16
SHA1 51b9e2d4cf4bbe3b78b03a9b6eb931e9b4f7af14
SHA512 b67821fdb7dad72bcdd21ff52669307b30d5e49c6b1256d1e23a1fa9c8fbfddcd88ce95048d6b25d78c7c75cde31d4a49975a194faa3d1566179bd3c87c1f244
SSDEEP 1536:1EGh0oLlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oLlqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe

Path C:\Windows\{DABE587D-EEE4-42b2-8B15-EACD1204B1CB}.exe
Size 168KB
SHA256 eba3e3a72f5f9e29a27f49f595aee75eef4a5e2d0b2b90745847d1ef25e88436
MD5 12fb4cad0eeb83c3e649d950ad1787cb
SHA1 e09fcc9e8776b0e572c64ab307412224a24b323d
SHA512 28a15850276658d01726b52fbe177a208c9810d3a2b1674051e43eccdea01aa942aaa8c514be3e57f8a615b34c95f71f769c4e9e69d877f74442cb010cf169d3
SSDEEP 1536:1EGh0oclq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oclqOPOe2MUVg3Ve+rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads