kinsing | 2afe2fed654c4514265a3d1b0f50cef25b9fc34351887a13d770457ba018492d

Analysis

max time kernel
92s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3_Документи.pdf.exe
Size 1.1MB
Sample240125-we5smsdadn
SHA256 2afe2fed654c4514265a3d1b0f50cef25b9fc34351887a13d770457ba018492d
MD5 a85a13ceb0a2fb1ac658a6cddc3628a5
SHA1 28ddbc9d2ecb7073fe329c59c73afa52e4973c1d
SHA512 0ced8655cf9b61a28bfeba5d16117caa1c1d87ebfa7622229fe43b0d36eb74bcead44b7f8412f8a38e505d57bcca33a6e3775e310dcd0cf9d1c9cf99ff4c2f47
SSDEEP 24576:JZ37GcN9ytIFGibL4fzXeoRVofL+0zA7TrjkoG0WIorgXIMLVPO2:JB7XK9iyjCT5A7T/SrdMLV22
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing lumma loader stealer

Malware Config

Extracted

Family

lumma

https://crisisestimatehealtwh.site/api

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	3_Документи.pdf.exe

Executes dropped EXE 1 IoCs

pid	Process
4816	Ri.pif

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	4816	WerFault.exe	99

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4944	tasklist.exe
2760	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4812	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4816	Ri.pif
4816	Ri.pif
4816	Ri.pif

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4436	2420	3_Документи.pdf.exe	88
PID 2420 wrote to memory of 4436	2420	3_Документи.pdf.exe	88
PID 2420 wrote to memory of 4436	2420	3_Документи.pdf.exe	88
PID 4436 wrote to memory of 3780	4436	cmd.exe	90
PID 4436 wrote to memory of 3780	4436	cmd.exe	90
PID 4436 wrote to memory of 3780	4436	cmd.exe	90
PID 3780 wrote to memory of 4944	3780	cmd.exe	91
PID 3780 wrote to memory of 4944	3780	cmd.exe	91
PID 3780 wrote to memory of 4944	3780	cmd.exe	91
PID 3780 wrote to memory of 4176	3780	cmd.exe	92
PID 3780 wrote to memory of 4176	3780	cmd.exe	92
PID 3780 wrote to memory of 4176	3780	cmd.exe	92
PID 3780 wrote to memory of 2760	3780	cmd.exe	94
PID 3780 wrote to memory of 2760	3780	cmd.exe	94
PID 3780 wrote to memory of 2760	3780	cmd.exe	94
PID 3780 wrote to memory of 4904	3780	cmd.exe	95
PID 3780 wrote to memory of 4904	3780	cmd.exe	95
PID 3780 wrote to memory of 4904	3780	cmd.exe	95
PID 3780 wrote to memory of 4164	3780	cmd.exe	96
PID 3780 wrote to memory of 4164	3780	cmd.exe	96
PID 3780 wrote to memory of 4164	3780	cmd.exe	96
PID 3780 wrote to memory of 4180	3780	cmd.exe	97
PID 3780 wrote to memory of 4180	3780	cmd.exe	97
PID 3780 wrote to memory of 4180	3780	cmd.exe	97
PID 3780 wrote to memory of 2940	3780	cmd.exe	98
PID 3780 wrote to memory of 2940	3780	cmd.exe	98
PID 3780 wrote to memory of 2940	3780	cmd.exe	98
PID 3780 wrote to memory of 4816	3780	cmd.exe	99
PID 3780 wrote to memory of 4816	3780	cmd.exe	99
PID 3780 wrote to memory of 4816	3780	cmd.exe	99
PID 3780 wrote to memory of 4812	3780	cmd.exe	100
PID 3780 wrote to memory of 4812	3780	cmd.exe	100
PID 3780 wrote to memory of 4812	3780	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\3_Документи.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\3_Документи.pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k cmd < Strings & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4944
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2760
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe"
      4⤵
      PID:4904
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir 8218
      4⤵
      PID:4164
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Tour + Wheel + Magical + Sides + Mf + Header 8218\Ri.pif
      4⤵
      PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Coupons + Her + Decorative 8218\d
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\8218\Ri.pif
      8218\Ri.pif 8218\d
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1444
        5⤵
        Program crash
        
        PID:628
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4816 -ip 4816
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ri.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\8218\Ri.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\8218\d
Size 1.1MB
SHA256 652ca8d800770c0592362d8223d23eb0811491a016670103d73942ee882014c2
MD5 b1c6275d28d8ef11215547a5a1dd041c
SHA1 f917f7c513b240714031ea8b3163570a8c419032
SHA512 01df5059612ada3e43ddf5051f06393a85705d9e5569ef05d8b03f61ade7f1e0060a3225924a3b944bd2c33fb911d21c0e4f5d52b5fd71de19a09dd0d5e82dde
SSDEEP 12288:MeYnEOc6X0eTnbkayF6WFZLA+GpgEiSpOjZj0HADKnN900OZaCP:MJcobtK90liDigDKnQ3aCP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Coupons

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Coupons
Size 470KB
SHA256 2c09af789c33b6a7f769a2076bffb025027b45e28ae21f588a8d431d5c2b7bca
MD5 868b4f1a860604da4de0fcbdeb8f3955
SHA1 f03051d88f48dd21b44525771e3e058848e50b98
SHA512 aa9e3d40b7d81747ec2e190bd899c59c233c3fbfdafe897fca8101537da50f7ac550704d8ebc25f78c09a1b4ecd51b6179fba56860a94f9d8ff1229fb21c2941
SSDEEP 6144:MMsbBNsBNnYysngAR4Oc6BZu39mmioH/umrUXk62eour/r7X:MeYnEOc6X0eTnX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Decorative

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Decorative
Size 287KB
SHA256 75df35ea009602413921f725b2579716ae76247b986735c31f5037bb2dbb3abb
MD5 11b0e09a31165d0b564ed6108247e32e
SHA1 9e44915c1778d17712ce609ab53043d4e270bfba
SHA512 28a44f9152900da7c4ea4a151aab0123d0089953b6b2a217d3dfb7860ea449720172658000589c04c4bdf597290afea32fab0cb53c1571592d4de9fc30210bfa
SSDEEP 3072:pkAqgDckWoMJjVr9EhSAxIcddVRD6LdoasvBQeRCg1S0o9pNxlUDOZaCTJd:pkbgDYokjV64AxHdVwdNKnN90bYOZaCP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Header

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Header
Size 103KB
SHA256 a5cc801b2db4523d6a7dfa40128b858bd3d297a7ea1607845fb535fd0d721f2c
MD5 e904474a7442c2d35dc17a05a2412ec1
SHA1 cb1c7570221703722cc54ead60460b0488ab29a5
SHA512 d56684844b13a0df8deacb7c92848eb7b56f12193c274fff7d3b42a1bd0ae4970fe0ba3c48242ae1b2c4746aecf79561e24e26816d9b5521ac9849a68b55839b
SSDEEP 1536:xRZg3EYrDWyu0uZo2+9BkxXiblenlJJyIE2UWb/hoQZ2OE3:xRZgDWy4ZNogXJ3i2Umb2Oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Her

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Her
Size 402KB
SHA256 7bac1c0e1a8337f9f8d6bb645bf35a6af5e986ccb163fa017dbec86a3cf01a84
MD5 9b6f23f0978c91d394472f6400c32e9e
SHA1 6e520ff244e6ff257a5cf96d6f0ae72fa98d749a
SHA512 8832bb69d0967ee4c28804d1babee6d99bf347194f7c0ccef780bb8a7530bc98139246ea2a246bb9bd62390dc9587111187d2cd556c93307f3c46e49e0a90c01
SSDEEP 6144:4ejkn6GsyB33WZdIFZLAW4MGeMetu5C71Spvl:rkayF6WFZLA+GpgEiSp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Magical

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Magical
Size 190KB
SHA256 95eb67f5407bb608c9d6b2972c87930a1ce4acbcaaf1f6308f3e5439e32dcea4
MD5 8dee4f87e8b028086bfb9c6e28c7efeb
SHA1 07022aebc3ae5a8966acfe372127f43794ef8c0c
SHA512 b30f3f265515fa7682d87a82c56a6073647c4c2ba75f08cacc01143d90ec8c06634326fd4d23596417d5c479507a79b81890a99b438f05fb53ad7eff3c235bd8
SSDEEP 3072:AZYvlfA6Gfza6iyY5tVGvH7fsUQwHJJX4xF5jtHk5B+LNBPcAvPTjFq9iOIXyTwW:AZ6lfA6Gfm608DsvqJX4xNAB+xHFq9OW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mf
Size 110KB
SHA256 e0fa999a7596408f51b11d427c5b4f290b8d7ce9d9b47c1a7a98361c728334bc
MD5 70c69b5c519979a93041dc147046963f
SHA1 1549258c1a0a8a957503cc6ee9f4768552469177
SHA512 8f8b2aa000b691caac1d0f32b8ef80e708e3cd9f4099e1c09fd837757ec15dc3cc1ff6ce72fc1c9bbab6a48a357ba6791c87c1de1db03d53e98da132751716a2
SSDEEP 768:C/mex/SGMAGWRqA60dTct4qNn2fhRE9PfKj+wsxyLtVSQsbZgar3R:CPdMaj6iTcohiPfKj+wsxjgarB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sides

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sides
Size 138KB
SHA256 c1211df077e49d47d212220fde380911265ead362b42605d20c829900fb151f1
MD5 c2db062feb62093ad5892db13fe4c706
SHA1 e17106b070b70dccf5d94d481b492c2ad6c16c8c
SHA512 6e983abb79fcfdd248241ab2d1a0ac3404fecc428e45863681b9fdd7f9fad3ee7fd0e8681b64d6d3a79295d9b9f721f576661e44aac7e055e74f9d466ec37143
SSDEEP 3072:nPOGU6WS2uLhxjRYH/fA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtc:nPOGUWLhxjRYmFqZvEAOz04pmde
MD5 SHA1 SHA512 SSDEEP

Submit Download

Strings

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Strings
Size 13KB
SHA256 7158e8faf43a3376141950870260798133098f81642e68056afd6dc3e1e1d776
MD5 23688d1a4ab6134d67d0183adeda1306
SHA1 d61ef6782c022ac4ec0d7389d10d80d7498984b3
SHA512 9808a88456f41d677cb6d8d1c493aba9bf4b7fc49ef88ab099030342fe65dc5473c9aa2c0747958fd0844a6a62750fc1bee15fc06cc7c6d5bf1b387030a90160
SSDEEP 384:SAiO8mtxn1bLeI0AOQ+7lV7AvROQiErnC/ui+awt:SnNkn1bE/m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tour

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tour
Size 188KB
SHA256 7fa7da730c634c4a21832d2d35cbe4a6d1484fcfadbae988e2e97a9ad76f73db
MD5 62a7e75d1df779e6169adb0cfa905694
SHA1 3f855dc814432bd0cd6e793c5a5bb2776b838602
SHA512 1f22866bfe4c6186b77c05aca2e4088c30e7ea1fe6057782a2a7aefda9221c78be2fe2cc5c673fd266e12218e91a66b254e90ff1d94f9ba6b8552c1e6bbc1698
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4S4/33S0:LQBk7JjX74cN0lrztgwU0Wyw3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wheel

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Wheel
Size 195KB
SHA256 37a743aa0ddda77e81dfb5c1ca3ab0ad2dff05237a87189af2867c82c4916a65
MD5 9f291e36e5804f3a1ea7456dea65b346
SHA1 e69a6a0df88a24dc318bfaf1a323b080c6ad7624
SHA512 7959b0279934eb093f9cfdcdb642a183440f2575bc1a3ccfdfe2a712fb15015739490be27303a78d29a7eb19d432cbc513385d25f7c789e0a9ddd78afed62abf
SSDEEP 6144:4FygyE4mqd12lqlEAehuqN8zwNzlmhPL1b5nZ2i:40K4mqClqlEZuB1b5Z2i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4816-36-0x0000000001490000-0x0000000001491000-memory.dmp

Download

memory/4816-37-0x00000000057A0000-0x0000000005829000-memory.dmp

Download

memory/4816-38-0x00000000057A0000-0x0000000005829000-memory.dmp

Download

memory/4816-39-0x00000000057A0000-0x0000000005829000-memory.dmp

Download

memory/4816-40-0x00000000057A0000-0x0000000005829000-memory.dmp

Download

memory/4816-41-0x00000000057A0000-0x0000000005829000-memory.dmp

Download

memory/4816-42-0x00000000057A0000-0x0000000005829000-memory.dmp

Download

memory/4816-43-0x00000000057A0000-0x0000000005829000-memory.dmp

Download