Analysis
-
max time kernel
91s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 17:50
General
-
Target
7522a5a4d1520a14aac119771083d991.exe
-
Size
81KB
-
MD5
7522a5a4d1520a14aac119771083d991
-
SHA1
404b05132cdca767e40b253500d54166c41ef13f
-
SHA256
bc014d182d2d1d3794b9eba539c0399103003b348f5b3cab468ac02f902c60cf
-
SHA512
7eb3db2f4f1d56c99904875733a084c30a293225ea104769e3ce0f5eae806960fdd04a21216a95f1afefdff09cfb13a1b5a8f4554837c04f453b3afcb82442bd
-
SSDEEP
1536:hpsMAiV5wD8/4Qr+0b1Y6aK82bdXnBDng431mTdxs:hpsMnuI/Z+41YvK8UXBDng4lmdS
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7522a5a4d1520a14aac119771083d991.exe"C:\Users\Admin\AppData\Local\Temp\7522a5a4d1520a14aac119771083d991.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7522a5a4d1520a14aac119771083d991.exeC:\Users\Admin\AppData\Local\Temp\7522a5a4d1520a14aac119771083d991.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5d40dfbaa2800b9ebe4ae81a827b274dd
SHA154d297d0a5bc9c684b259a57047f7fea72ee27f0
SHA256472378807a83f83731bcaeb9708cd3cea60b975484452f4f732bc674598d2889
SHA512a6f2ef5231199306cc098c338e224de6aa1a83eff5d9dec82a611d71a839b7afd8b94e4e23111bfd8ee63ff0cef7a0e287d5c99c9eafc653a804a19aa58b9e44
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
108KB