kinsing | abfcaae1e6f7b625f4688110bf96be20f1d09817dc3cfb489bbba117705c229b | Triage

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:43

Sharing

Report Analysis Logs

General

Target

751fc385dcf3ad8c41c8d00215440661.exe
Size

194KB
MD5

751fc385dcf3ad8c41c8d00215440661
SHA1

7c33b6b9e3b4bccc9bc22cbe01872352d449b103
SHA256

abfcaae1e6f7b625f4688110bf96be20f1d09817dc3cfb489bbba117705c229b
SHA512

830a9d492570997746ad5b099d9e6f463829d1ae44eb6864620d2012d5429854542d75a42e56b295cd9022de8972d2091ffdf86db0ba0cf4fcd36daca340da76
SSDEEP

6144:eEJudAILVANvA/o/u549UGSiSbs4IEYRz5:eE0+QVovAYu5hbs4IBRF

Score

10^/10

kinsing loader upx

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5056-0-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/5056-2-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	5056	WerFault.exe	72

C:\Users\Admin\AppData\Local\Temp\751fc385dcf3ad8c41c8d00215440661.exe
"C:\Users\Admin\AppData\Local\Temp\751fc385dcf3ad8c41c8d00215440661.exe"
1⤵
PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 336
  2⤵
  - Program crash
  PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5056 -ip 5056
1⤵
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5056-1-0x00000000005A0000-0x00000000005B4000-memory.dmp

Filesize
80KB

Download
memory/5056-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download