kinsing | 0f6f73652f44192fa235488f68747cf8c6abc83139a13b00df491dbbab7ec5ce

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7522301a75daa0a9afb3bb82d1286956.exe
Size 506KB
Sample240125-wdx2eadabl
SHA256 0f6f73652f44192fa235488f68747cf8c6abc83139a13b00df491dbbab7ec5ce
MD5 7522301a75daa0a9afb3bb82d1286956
SHA1 b7c825b1abcdb96e89491ae1db98f340c21023a9
SHA512 418c620ec48a75a0747bff40ab9203664a926d593ddf3c8be686a8a4603a4ff77c3185eccc4be2ee82c3cbb2a38b371dee13130870d45f31153028c5605a85ef
SSDEEP 12288:Xox7c2TPv7kRvVfxh1Q4Qq8YACCftal5xv1kle59:6c6v7wHh24QZCWGsY59
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Deletes itself 1 IoCs

pid	Process
1920	7522301a75daa0a9afb3bb82d1286956.exe

Executes dropped EXE 1 IoCs

pid	Process
1920	7522301a75daa0a9afb3bb82d1286956.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1920	7522301a75daa0a9afb3bb82d1286956.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	7522301a75daa0a9afb3bb82d1286956.exe
1920	7522301a75daa0a9afb3bb82d1286956.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1392	7522301a75daa0a9afb3bb82d1286956.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1392	7522301a75daa0a9afb3bb82d1286956.exe
1920	7522301a75daa0a9afb3bb82d1286956.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1920	1392	7522301a75daa0a9afb3bb82d1286956.exe	88
PID 1392 wrote to memory of 1920	1392	7522301a75daa0a9afb3bb82d1286956.exe	88
PID 1392 wrote to memory of 1920	1392	7522301a75daa0a9afb3bb82d1286956.exe	88
PID 1920 wrote to memory of 544	1920	7522301a75daa0a9afb3bb82d1286956.exe	90
PID 1920 wrote to memory of 544	1920	7522301a75daa0a9afb3bb82d1286956.exe	90
PID 1920 wrote to memory of 544	1920	7522301a75daa0a9afb3bb82d1286956.exe	90

C:\Users\Admin\AppData\Local\Temp\7522301a75daa0a9afb3bb82d1286956.exe
"C:\Users\Admin\AppData\Local\Temp\7522301a75daa0a9afb3bb82d1286956.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\7522301a75daa0a9afb3bb82d1286956.exe
  C:\Users\Admin\AppData\Local\Temp\7522301a75daa0a9afb3bb82d1286956.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7522301a75daa0a9afb3bb82d1286956.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7522301a75daa0a9afb3bb82d1286956.exe

Path C:\Users\Admin\AppData\Local\Temp\7522301a75daa0a9afb3bb82d1286956.exe
Size 506KB
SHA256 4e34e7a696dfb73f1cb90a16da711b0fa129ffbee89d9da174822db8d935e6c5
MD5 9b792cb9b0c58ffab635fa3a78cb2832
SHA1 8587287d758edb6abe212f37d0436a6299e4cc56
SHA512 96915bcd555066e62d5f2d4666164027e23d2bf6bb6ff54f1280a9a1db148cd5ed0fcaeb6436e871cfe474c6a5c7980c703ddb5aa658198a8e6a4a42c21fca02
SSDEEP 12288:XEN4OKgReHWM7w5LVrAaKGZqH6O66FhJ7ayy5CY:XENfKg7M7SVre2qH6OTJZy5p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1392-1-0x0000000001670000-0x00000000016F3000-memory.dmp

Download

memory/1392-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1392-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1920-13-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1920-15-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/1920-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1920-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Download

memory/1920-27-0x0000000000400000-0x000000000045B000-memory.dmp

Download