Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:46
General
-
Target
7521127b4c17dddb95de16f7ac206a7f.exe
-
Size
84KB
-
MD5
7521127b4c17dddb95de16f7ac206a7f
-
SHA1
f3446785fac84a4abcc6836964ad5d6416c96b38
-
SHA256
21dca41b3e9fbda8dff300d4e8b17bbcfa05b8f53a2bf6021d93affeeab9503e
-
SHA512
a4098f815cef68ba6bcfe94c9b06284bf2e83f6204fdbb5574b72b857be48c6bcad40abf256ba02c4a4ef865eadc561d7604096da0d8ac7404886b5b6918fc57
-
SSDEEP
1536:zmjH0ihMIEfzAekMxcK9Whgo5YxkV1RXksYtBbbfh:aD0cMIYzArMS8Whgo51lYJ
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7521127b4c17dddb95de16f7ac206a7f.exe"C:\Users\Admin\AppData\Local\Temp\7521127b4c17dddb95de16f7ac206a7f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7521127b4c17dddb95de16f7ac206a7f.exeC:\Users\Admin\AppData\Local\Temp\7521127b4c17dddb95de16f7ac206a7f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5a96c00adf285f00114a1748f913984c4
SHA115778b1f188f794752b3d6522b0c7917868d2f1d
SHA25627245faad7cfbb63d639721ab466088b4e52972339e2243a2cf5e33abdf3a287
SHA512a956e1bb1b3dd62630dc8fd7a1cdd40298059dc2f47e59a558eb7411a086aef8515deae4b114d4004dcb43c191cb80c7c1895492958195c20cf62acf087f34dd
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB