Overview

overview

10

Static

static

3

7521eded17...4c.exe

windows7-x64

7

7521eded17...4c.exe

windows10-2004-x64

10

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

10

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

10

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

10

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

10

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

10

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 17:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7521eded174ca2d986fc3bed2996684c.exe
  • Size 556KB
  • Sample240125-wdr56acaf2
  • SHA256 0bd9d4d94518ec8bc8a148f1a42877865b9468e0bf417f74f3c88302e7f2b043
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kinsingloader

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\7521eded174ca2d986fc3bed2996684c.exe
    "C:\Users\Admin\AppData\Local\Temp\7521eded174ca2d986fc3bed2996684c.exe"
    1⤵
    • Loads dropped DLL
    PID:4484

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InstallOptions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\InstallOptions.dll
        • Size 14KB
        • SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LangDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NSISdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\UAC.dll
        • Size 17KB
        • SHA256 3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ioSpecial.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\ioSpecial.ini
        • Size 403B
        • SHA256 a5b4a9122ac8fe76cecc63f090f20d9fb75dba2ff0887382612b581517c78bdf
        • MD5 SHA1 SHA512
        Submit Download

        ioSpecial.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\ioSpecial.ini
        • Size 1KB
        • SHA256 caeaba0781e83f7c6713b25222e51d76d388bcc377b0ad258950bbb830eb56a8
        • MD5 SHA1 SHA512
        Submit Download

        linker.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\linker.dll
        • Size 7KB
        • SHA256 67552ebf58e98e841dcd9f4213ad3eb134d595f04839771618f0bb1c48ea2b92
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download