kinsing | 063ffa646d1e409fc25f53a2e077eb68a0a6aa763692520e6187a511e1ea86ee | Triage

Analysis

max time kernel
134s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:44

Sharing

Report Analysis Logs

General

Target

751fe8a374b8a63a86b0456bac3d36bd.exe
Size

310KB
MD5

751fe8a374b8a63a86b0456bac3d36bd
SHA1

7e601b9f497ebe93dc5c681d5bc544dcf253d189
SHA256

063ffa646d1e409fc25f53a2e077eb68a0a6aa763692520e6187a511e1ea86ee
SHA512

9704122436db5d184245d88a350ca9693a4cf43b12ba867c6a7408b31cc0f9f20fc2fa6367de1825c39aa0f06b54617e062a8d114df902945e192f5fb0082c38
SSDEEP

6144:/7ROY0kFrKTleoP1hex4NYDzrljwD5OSlpdsi10aEPH:/Y8eTlTi4GbiUS/sW

Score

10^/10

kinsing modiloader loader trojan

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3924-2-0x0000000000400000-0x000000000044D000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3196	3924	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\751fe8a374b8a63a86b0456bac3d36bd.exe
"C:\Users\Admin\AppData\Local\Temp\751fe8a374b8a63a86b0456bac3d36bd.exe"
1⤵
PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 332
  2⤵
  - Program crash
  PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3924 -ip 3924
1⤵
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-0-0x00000000009B0000-0x0000000000A07000-memory.dmp

Filesize
348KB

Download
memory/3924-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download