kronos | aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3

General

Target

aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
Size

344KB
MD5

14a20867d0d6519be768b17ad3cefefe
SHA1

c955e587f0f84df8cfd27b23f70be1de11253b29
SHA256

aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3
SHA512

69b50b95e59ccd2e19577e22560edff5d63c844558b05456481c83d7678dff50a99798ff7132b0aeb728795f14fe77222096a3b5e2296fdb80b95ca310f2807e
SSDEEP

6144:RerQu7SGFRDauuLk8fk3tdG2smOOHhmlbobTfCF9NRRya6AE7Gya6AE:UcKSyQ2dBhhmlbot

Score

10^/10

kronos banker botnet evasion persistence

Malware Config

Signatures

Kronos
banker botnet kronos

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{9AF9AF3D-F414-4370-8F12-36313A2E5ADA}\\f5ea51da.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{9AF9AF3D-F414-4370-8F12-36313A2E5ADA}\\f5ea51da.exe"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe

Suspicious behavior: MapViewOfSection 26 IoCs

Processes:

aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exesvchost.exe

pid	process
1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe
1720	svchost.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeDebugPrivilege	1720	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	880
Token: SeIncreaseQuotaPrivilege	880
Token: SeSecurityPrivilege	880
Token: SeTakeOwnershipPrivilege	880
Token: SeLoadDriverPrivilege	880
Token: SeRestorePrivilege	880
Token: SeSystemEnvironmentPrivilege	880
Token: SeAssignPrimaryTokenPrivilege	880
Token: SeIncreaseQuotaPrivilege	880
Token: SeSecurityPrivilege	880
Token: SeTakeOwnershipPrivilege	880
Token: SeLoadDriverPrivilege	880
Token: SeSystemtimePrivilege	880
Token: SeBackupPrivilege	880
Token: SeRestorePrivilege	880
Token: SeShutdownPrivilege	880
Token: SeSystemEnvironmentPrivilege	880
Token: SeUndockPrivilege	880
Token: SeManageVolumePrivilege	880
Token: SeAssignPrimaryTokenPrivilege	880
Token: SeIncreaseQuotaPrivilege	880
Token: SeSecurityPrivilege	880
Token: SeTakeOwnershipPrivilege	880
Token: SeLoadDriverPrivilege	880
Token: SeRestorePrivilege	880
Token: SeSystemEnvironmentPrivilege	880
Token: SeAssignPrimaryTokenPrivilege	880
Token: SeIncreaseQuotaPrivilege	880
Token: SeSecurityPrivilege	880
Token: SeTakeOwnershipPrivilege	880
Token: SeLoadDriverPrivilege	880
Token: SeRestorePrivilege	880
Token: SeSystemEnvironmentPrivilege	880
Token: SeAuditPrivilege	880

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1224
1224
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1224
1224
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe

pid process

1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
Suspicious use of UnmapMainImage 5 IoCs

Processes:

aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe

pid process

1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
816
816
816
816

pid	process
1224
1224

pid	process
1224
1224

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe

description	pid	process	target process
PID 1992 wrote to memory of 1720	1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe	svchost.exe
PID 1992 wrote to memory of 1720	1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe	svchost.exe
PID 1992 wrote to memory of 1720	1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe	svchost.exe
PID 1992 wrote to memory of 1720	1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
"C:\Users\Admin\AppData\Local\Temp\aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-73-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download
memory/296-79-0x0000000000B60000-0x0000000000B65000-memory.dmp

Filesize
20KB

Download
memory/336-71-0x0000000001F00000-0x0000000001F05000-memory.dmp

Filesize
20KB

Download
memory/372-69-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/384-70-0x0000000000210000-0x0000000000215000-memory.dmp

Filesize
20KB

Download
memory/420-72-0x0000000000050000-0x0000000000055000-memory.dmp

Filesize
20KB

Download
memory/468-74-0x0000000000180000-0x0000000000185000-memory.dmp

Filesize
20KB

Download
memory/476-75-0x0000000000190000-0x0000000000195000-memory.dmp

Filesize
20KB

Download
memory/484-77-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download
memory/600-83-0x0000000000520000-0x0000000000525000-memory.dmp

Filesize
20KB

Download
memory/676-84-0x00000000003C0000-0x00000000003C5000-memory.dmp

Filesize
20KB

Download
memory/760-85-0x0000000000900000-0x0000000000905000-memory.dmp

Filesize
20KB

Download
memory/816-78-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/856-86-0x00000000006A0000-0x00000000006A5000-memory.dmp

Filesize
20KB

Download
memory/880-87-0x0000000000930000-0x0000000000935000-memory.dmp

Filesize
20KB

Download
memory/1028-88-0x0000000000190000-0x0000000000195000-memory.dmp

Filesize
20KB

Download
memory/1076-89-0x0000000000090000-0x0000000000095000-memory.dmp

Filesize
20KB

Download
memory/1132-80-0x0000000000210000-0x0000000000215000-memory.dmp

Filesize
20KB

Download
memory/1184-90-0x0000000000330000-0x0000000000335000-memory.dmp

Filesize
20KB

Download
memory/1224-81-0x0000000002190000-0x0000000002195000-memory.dmp

Filesize
20KB

Download
memory/1252-93-0x0000000000120000-0x0000000000125000-memory.dmp

Filesize
20KB

Download
memory/1632-91-0x00000000007E0000-0x00000000007E5000-memory.dmp

Filesize
20KB

Download
memory/1720-68-0x00000000000D0000-0x00000000000D5000-memory.dmp

Filesize
20KB

Download
memory/1720-67-0x0000000000E20000-0x0000000000E28000-memory.dmp

Filesize
32KB

Download
memory/1720-63-0x0000000000000000-mapping.dmp

Download
memory/1720-66-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1720-76-0x0000000000AD0000-0x0000000000C94000-memory.dmp

Filesize
1.8MB

Download
memory/1908-92-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download
memory/1992-60-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1992-56-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1992-65-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2020-82-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download

pid	process
1992	aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
816
816
816
816

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads