kinsing | 223a6ae0d17b633d2beefc9263dfa1cc0b201094531f0973a3e4bda55340a4c9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe
Size

32KB
MD5

2a87e8cb481eb3b5293e8478f89a71bf
SHA1

a8163de316a39e694b4393147eff96a8311d0992
SHA256

223a6ae0d17b633d2beefc9263dfa1cc0b201094531f0973a3e4bda55340a4c9
SHA512

af78053aa2bf04b703481267e3a4fcfb2010b53d973e29adf00aedae1ee9c292547e6071b44b14145fe4d7f2603df29f4fd173e6e49702245ba02a03662ba2b3
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJXTQke8SEG3/:bA74zYcgT/Ekd0ryfjQRSNhpSBv

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000002315f-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3316	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 3316	1908	2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe	89
PID 1908 wrote to memory of 3316	1908	2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe	89
PID 1908 wrote to memory of 3316	1908	2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_2a87e8cb481eb3b5293e8478f89a71bf_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
32KB

MD5
deef06e425366b3da960bbb1613d233b

SHA1
66144417c68a40318866edebcc5807dfd5f1cdba

SHA256
e8742c6bb43e197a3f6ff12218a2548db2b5d06f5ae0e34853edee9473462d00

SHA512
fe5236abcf34ec6242a9c8e0b1cfbc874f2a715c8e8a478d9bcbdd768f81f3051864e56ec19effc5995f475ca10ea00362ed552e9e1494376cf817683c7484c2

Download Submit
memory/1908-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1908-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1908-2-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/3316-19-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download