kronos | 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5

General

Target

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
Size

388KB
MD5

2557cdb9f495107cacba536a0338d5f0
SHA1

7a034ec992d17c6e7bd0ca97121585be1f66fca2
SHA256

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5
SHA512

5bf37419495bd623a4f51c03c720bbfb75f06f6522a5db24f99b41d9034912a0de35bb64e94f81c2882165c74a9d34aa9b4af9f5e36941a8924913eba4106687
SSDEEP

6144:LYHeIdOLd7RI0zjnyXKzAzEVJXW2PQwpU7k95fcLlfXDTGqAed:LYHe7RI/KjnZRm7gfs

Score

10^/10

kronos banker botnet persistence

Malware Config

Signatures

Kronos
banker botnet kronos

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{37AAD372-DEE8-476F-9E4D-8FC64CE65039}\\f5ea51da.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{37AAD372-DEE8-476F-9E4D-8FC64CE65039}\\f5ea51da.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

description	pid	process	target process
PID 1420 set thread context of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE

pid	process
1276	Explorer.EXE

Suspicious behavior: MapViewOfSection 26 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exesvchost.exe

pid	process
1984	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
1984	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe
1512	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeDebugPrivilege	1512	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	872
Token: SeIncreaseQuotaPrivilege	872
Token: SeSecurityPrivilege	872
Token: SeTakeOwnershipPrivilege	872
Token: SeLoadDriverPrivilege	872
Token: SeRestorePrivilege	872
Token: SeSystemEnvironmentPrivilege	872
Token: SeAssignPrimaryTokenPrivilege	872
Token: SeIncreaseQuotaPrivilege	872
Token: SeSecurityPrivilege	872
Token: SeTakeOwnershipPrivilege	872
Token: SeLoadDriverPrivilege	872
Token: SeSystemtimePrivilege	872
Token: SeBackupPrivilege	872
Token: SeRestorePrivilege	872
Token: SeShutdownPrivilege	872
Token: SeSystemEnvironmentPrivilege	872
Token: SeUndockPrivilege	872
Token: SeManageVolumePrivilege	872
Token: SeAssignPrimaryTokenPrivilege	872
Token: SeIncreaseQuotaPrivilege	872
Token: SeSecurityPrivilege	872
Token: SeTakeOwnershipPrivilege	872
Token: SeLoadDriverPrivilege	872
Token: SeRestorePrivilege	872
Token: SeSystemEnvironmentPrivilege	872
Token: SeAssignPrimaryTokenPrivilege	872
Token: SeIncreaseQuotaPrivilege	872
Token: SeSecurityPrivilege	872
Token: SeTakeOwnershipPrivilege	872
Token: SeLoadDriverPrivilege	872
Token: SeRestorePrivilege	872
Token: SeSystemEnvironmentPrivilege	872
Token: SeAssignPrimaryTokenPrivilege	872
Token: SeIncreaseQuotaPrivilege	872
Token: SeSecurityPrivilege	872
Token: SeTakeOwnershipPrivilege	872

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

pid process

1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
Suspicious use of UnmapMainImage 6 IoCs

Processes:

pid process

804
804
804
804
804
804

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

pid	process
804
804
804
804
804
804

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
- C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
  "C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
    "C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-68-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download
memory/272-88-0x0000000000760000-0x0000000000765000-memory.dmp

Filesize
20KB

Download
memory/280-82-0x0000000000960000-0x0000000000965000-memory.dmp

Filesize
20KB

Download
memory/328-83-0x0000000001B20000-0x0000000001B25000-memory.dmp

Filesize
20KB

Download
memory/336-69-0x00000000006F0000-0x00000000006F5000-memory.dmp

Filesize
20KB

Download
memory/372-70-0x0000000000150000-0x0000000000155000-memory.dmp

Filesize
20KB

Download
memory/388-71-0x0000000000310000-0x0000000000315000-memory.dmp

Filesize
20KB

Download
memory/424-72-0x00000000000C0000-0x00000000000C5000-memory.dmp

Filesize
20KB

Download
memory/468-73-0x0000000000270000-0x0000000000275000-memory.dmp

Filesize
20KB

Download
memory/484-74-0x0000000000950000-0x0000000000955000-memory.dmp

Filesize
20KB

Download
memory/492-75-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download
memory/548-89-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download
memory/592-76-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/668-77-0x00000000002B0000-0x00000000002B5000-memory.dmp

Filesize
20KB

Download
memory/752-78-0x00000000002A0000-0x00000000002A5000-memory.dmp

Filesize
20KB

Download
memory/804-79-0x0000000000190000-0x0000000000195000-memory.dmp

Filesize
20KB

Download
memory/840-80-0x0000000000090000-0x0000000000095000-memory.dmp

Filesize
20KB

Download
memory/872-81-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/1040-84-0x0000000000280000-0x0000000000285000-memory.dmp

Filesize
20KB

Download
memory/1132-85-0x0000000001DE0000-0x0000000001DE5000-memory.dmp

Filesize
20KB

Download
memory/1236-86-0x0000000000120000-0x0000000000125000-memory.dmp

Filesize
20KB

Download
memory/1276-87-0x0000000001CE0000-0x0000000001CE5000-memory.dmp

Filesize
20KB

Download
memory/1276-99-0x000007FEF67D0000-0x000007FEF6913000-memory.dmp

Filesize
1.3MB

Download
memory/1276-100-0x000007FF43D00000-0x000007FF43D0A000-memory.dmp

Filesize
40KB

Download
memory/1420-56-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1512-62-0x0000000000000000-mapping.dmp

Download
memory/1512-65-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1512-66-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download
memory/1512-67-0x00000000001A0000-0x00000000001A5000-memory.dmp

Filesize
20KB

Download
memory/1512-92-0x0000000002050000-0x0000000002214000-memory.dmp

Filesize
1.8MB

Download
memory/1828-90-0x0000000000180000-0x0000000000185000-memory.dmp

Filesize
20KB

Download
memory/1968-91-0x00000000002A0000-0x00000000002A5000-memory.dmp

Filesize
20KB

Download
memory/1984-63-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1984-58-0x0000000000415BCE-mapping.dmp

Download
memory/1984-57-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1984-61-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

description	pid	process	target process
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1420 wrote to memory of 1984	1420	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 1984 wrote to memory of 1512	1984	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe
PID 1984 wrote to memory of 1512	1984	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe
PID 1984 wrote to memory of 1512	1984	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe
PID 1984 wrote to memory of 1512	1984	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe
PID 388 wrote to memory of 1276	388		Explorer.EXE

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads