Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:49

General

  • Target

    75223dcf04ed991c3c6285b3a8fcfeb9.exe

  • Size

    143KB

  • MD5

    75223dcf04ed991c3c6285b3a8fcfeb9

  • SHA1

    3e829e04b2b5e0dec8deb30b03de94771894a09d

  • SHA256

    3be80cfa604086072f7763041a1324bce517f90d67d401c81a8297ed60699f99

  • SHA512

    79263f738fb2e2b0d293d8a6ea53f381afaade88688b21144239bb0be6730c632089b11d8b87c6a813bff5cf53e67537b7723bc9df7d30848315903a81e5a1c0

  • SSDEEP

    3072:XJqmWJGq7dW9p6ra8cWaBCFW4fFFrdEMPXgbnVfAW3hpSt:smmdUv8cWaBCFW4tZ+kXgbnGKpS

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Modifies AppInit DLL entries 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\75223dcf04ed991c3c6285b3a8fcfeb9.exe
        "C:\Users\Admin\AppData\Local\Temp\75223dcf04ed991c3c6285b3a8fcfeb9.exe"
        2⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240611437.bat" "C:\Users\Admin\AppData\Local\Temp\75223dcf04ed991c3c6285b3a8fcfeb9.exe""
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:916
          • C:\Windows\SysWOW64\attrib.exe
            attrib -r -s -h"C:\Users\Admin\AppData\Local\Temp\75223dcf04ed991c3c6285b3a8fcfeb9.exe"
            4⤵
            • Views/modifies file attributes
            PID:4924
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 524
            4⤵
            • Program crash
            PID:5104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 1280
          3⤵
          • Program crash
          PID:3368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4804 -ip 4804
      1⤵
        PID:4800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 916 -ip 916
        1⤵
          PID:1344

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\240611437.bat

          Filesize

          69B

          MD5

          604802586163bdc9eda42f6a471e01ad

          SHA1

          fc255017a78e3ec103f73c8c8651effe08089c81

          SHA256

          02f35eec8f33e1ad57621253ee252ca073f6cc16bf9712d89859ffeb6bb49dd3

          SHA512

          66dc346d7bdcc80fc8ae6894ae10cab306aaf5cf1c1dd750a971d3df37d6f4ac607d188f583d08b526e3df13234cec9c7fa7f9bdc4c4ad187fc83a3506b94888

        • C:\Windows\SysWOW64\ddoddump.dll

          Filesize

          63KB

          MD5

          e0fd7f29011e26683fee67b52232905a

          SHA1

          e0c9ccbe79539a0287b6ebce858870af0ce7c8ff

          SHA256

          38328718c33c7e60a738cd8f79c78f48791f0e76d6dcf6babc69c3b5fc71e2d1

          SHA512

          b0c2e07aa00e85d2b74e299f24236097aff8a359d7a21496c8ee7b1926ba67d2f758daf11cba7b81ca4ce158d61bffda1536d8d9a476d451469595d48a76e29f

        • memory/916-13-0x0000000010000000-0x0000000010013000-memory.dmp

          Filesize

          76KB

        • memory/4804-0-0x0000000001000000-0x0000000001025000-memory.dmp

          Filesize

          148KB

        • memory/4804-8-0x0000000010000000-0x0000000010013000-memory.dmp

          Filesize

          76KB

        • memory/4804-9-0x0000000001000000-0x0000000001025000-memory.dmp

          Filesize

          148KB