kinsing | 8e5d78774044ceba3066a0214ea16f1718f5489b8d4a8a53984b925072c7fa16

General

Target

752501dcf3fb2da30771709d786d1bf1.exe
Size

195KB
MD5

752501dcf3fb2da30771709d786d1bf1
SHA1

92d352e23f0695307ff42fe32c0cc6939f11a7aa
SHA256

8e5d78774044ceba3066a0214ea16f1718f5489b8d4a8a53984b925072c7fa16
SHA512

cb18a13a0e2ac6d4cf8250fc306ed288f765212028ac5e93732b4c3ba300874bf81ce672f3cf392a12662161a197c5da83487239a9051abf4a311420942eb6a3
SSDEEP

6144:zX88dBeX5oci4bz/uSxd+8ncml+8EbPqN:DBdBy5cEvQ8EbP2

Score

10^/10

kinsing loader persistence

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Loads dropped DLL 1 IoCs

Processes:

Explorer.EXE

pid process

3540 Explorer.EXE

pid	process
3540	Explorer.EXE

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3336304223-2978740688-3645194410-1000\\$0c836f54c97f1b30d0f5166444f0e3a2\\n."	752501dcf3fb2da30771709d786d1bf1.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Modifies registry class 5 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	752501dcf3fb2da30771709d786d1bf1.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3336304223-2978740688-3645194410-1000\\$0c836f54c97f1b30d0f5166444f0e3a2\\n."	752501dcf3fb2da30771709d786d1bf1.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\clsid	752501dcf3fb2da30771709d786d1bf1.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exeExplorer.EXE

pid	process
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3584	752501dcf3fb2da30771709d786d1bf1.exe
3540	Explorer.EXE
3540	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3584	752501dcf3fb2da30771709d786d1bf1.exe
Token: SeDebugPrivilege	3584	752501dcf3fb2da30771709d786d1bf1.exe
Token: SeDebugPrivilege	3584	752501dcf3fb2da30771709d786d1bf1.exe
Token: SeDebugPrivilege	3540	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3540 Explorer.EXE

pid	process
3540	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	pid	process	target process
PID 3584 wrote to memory of 3540	3584	752501dcf3fb2da30771709d786d1bf1.exe	Explorer.EXE
PID 3584 wrote to memory of 3540	3584	752501dcf3fb2da30771709d786d1bf1.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3540

C:\Users\Admin\AppData\Local\Temp\752501dcf3fb2da30771709d786d1bf1.exe
"C:\Users\Admin\AppData\Local\Temp\752501dcf3fb2da30771709d786d1bf1.exe"
2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\$0c836f54c97f1b30d0f5166444f0e3a2\n
Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/3540-16-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/3540-12-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/3584-4-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/3584-6-0x00000000021D0000-0x0000000002202000-memory.dmp

Filesize
200KB

Download
memory/3584-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3584-7-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/3584-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3584-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3584-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3584-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3584-15-0x00000000021D0000-0x0000000002202000-memory.dmp

Filesize
200KB

Download
memory/3584-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads