kinsing | f4599256f05528fb5bcc1b2dc94cc748f810a18cafccc69a4ad4896552c9887c | Triage

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:44

Sharing

Report Analysis Logs

General

Target

75201002014531d19468f6144a3d7aa6.exe
Size

274KB
MD5

75201002014531d19468f6144a3d7aa6
SHA1

9817f12864f637b15dce22d5cbc4d3abc9f8abef
SHA256

f4599256f05528fb5bcc1b2dc94cc748f810a18cafccc69a4ad4896552c9887c
SHA512

4b5136bffce7263f62d01cadf51a1532c4e280124fadd6875d3da5607fbde291f97dca80897960874fb3579c54a81c9c117317b5af761b44a756320ec0278339
SSDEEP

6144:NSScKI5EcqqLZ8k0GItitLXdYttiJmyXf3l:iKI5EXqLpP8M5YcmM

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	75201002014531d19468f6144a3d7aa6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	75201002014531d19468f6144a3d7aa6.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	75201002014531d19468f6144a3d7aa6.exe
File created	C:\Windows\assembly\Desktop.ini	75201002014531d19468f6144a3d7aa6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	75201002014531d19468f6144a3d7aa6.exe

C:\Users\Admin\AppData\Local\Temp\75201002014531d19468f6144a3d7aa6.exe
"C:\Users\Admin\AppData\Local\Temp\75201002014531d19468f6144a3d7aa6.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download
memory/2876-1-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download
memory/2876-2-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/2876-6-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download