Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:43

General

  • Target

    751f73044d0b419d6ddb606917bb59ac.exe

  • Size

    385KB

  • MD5

    751f73044d0b419d6ddb606917bb59ac

  • SHA1

    20c19cff1d3a5b38cd5fe9725f84dad4fd065f5e

  • SHA256

    85cdb11bbcb91fa874b5ff4eee8565d7f64421bc17965dbafc932e387397ad71

  • SHA512

    b8893a18922041cb3825f88f5cf3749aafbcb36ee0f0459251e1c770207833975fb69237782b948f8a32c39764e71d29368d7ad30925a462682edbe2a70cb69b

  • SSDEEP

    6144:NcXKbTgeHqR6t3AFVZFv7c6j2R5EmKblrvM/wBQb+RHSgJKQfJWCB:NweHKBZF1YZIlSPwHSgJdfJWCB

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\751f73044d0b419d6ddb606917bb59ac.exe
    "C:\Users\Admin\AppData\Local\Temp\751f73044d0b419d6ddb606917bb59ac.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\751f73044d0b419d6ddb606917bb59ac.exe
      C:\Users\Admin\AppData\Local\Temp\751f73044d0b419d6ddb606917bb59ac.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\751f73044d0b419d6ddb606917bb59ac.exe

    Filesize

    385KB

    MD5

    872e70cb448f13b8270b919f96f23d94

    SHA1

    d84d7db54c843844ceea06f917dd247c4f6c7c65

    SHA256

    6045c6ae9e6d4d0142d2d5ad09e21d0a989b7ab29d1602ec47cad395660336ac

    SHA512

    eb32434c7518d0fe7707ea5a3b1a5d53096ec6552677dd817e1a3b9f7b07d4968f9f2dd65d09ad82bc89e8ab83e8650afa4379bc0874253c1f3be6f428677698

  • memory/772-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/772-1-0x0000000001470000-0x00000000014D6000-memory.dmp

    Filesize

    408KB

  • memory/772-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/772-12-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1152-13-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1152-14-0x00000000015E0000-0x0000000001646000-memory.dmp

    Filesize

    408KB

  • memory/1152-20-0x0000000004F20000-0x0000000004F7F000-memory.dmp

    Filesize

    380KB

  • memory/1152-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1152-32-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1152-36-0x000000000C720000-0x000000000C75C000-memory.dmp

    Filesize

    240KB

  • memory/1152-38-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB