kinsing | 7a74fb60899179d6a5696a266139cde1f7a05660c73fccf636650e643ae67d21 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:50

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Dialer.dll
Size

3KB
MD5

692da284b3212a65a8092e6f02804c05
SHA1

852b2943a19f0a7de5e6fa2a47aee8a2ce8e3c66
SHA256

0d9663a5d1eab84f531dcac47a2366d215207ac488f9d452832c5efb91a6d1f9
SHA512

978a8ec097d30c2a8729670e8fdf46464e84c9e701b9739e4937991c07cd06003c0bb01e77ad1e10f30b7ae2fb62b5b7bc724bce4ce644b09177899c6bacb21f

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	4824	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4824	864	rundll32.exe	72
PID 864 wrote to memory of 4824	864	rundll32.exe	72
PID 864 wrote to memory of 4824	864	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 608
    3⤵
    - Program crash
    PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 4824
1⤵
PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads