kronos | 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5

General

Target

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
Size

388KB
MD5

2557cdb9f495107cacba536a0338d5f0
SHA1

7a034ec992d17c6e7bd0ca97121585be1f66fca2
SHA256

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5
SHA512

5bf37419495bd623a4f51c03c720bbfb75f06f6522a5db24f99b41d9034912a0de35bb64e94f81c2882165c74a9d34aa9b4af9f5e36941a8924913eba4106687
SSDEEP

6144:LYHeIdOLd7RI0zjnyXKzAzEVJXW2PQwpU7k95fcLlfXDTGqAed:LYHe7RI/KjnZRm7gfs

Score

10^/10

kronos banker botnet persistence

Malware Config

Signatures

Kronos
banker botnet kronos

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6815cdb9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{428EADEC-1087-4398-8289-9C825646B5C9}\\6815cdb9.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6815cdb9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{428EADEC-1087-4398-8289-9C825646B5C9}\\6815cdb9.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

description	pid	process	target process
PID 3720 set thread context of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2824 4356 WerFault.exe svchost.exe

pid	pid_target	process	target process
2824	4356	WerFault.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

svchost.exe

pid	process
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe
4356	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

pid	process
3756	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
3756	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

pid process

3720 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

pid	process
3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe

description	pid	process	target process
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3720 wrote to memory of 3756	3720	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
PID 3756 wrote to memory of 4356	3756	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe
PID 3756 wrote to memory of 4356	3756	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe
PID 3756 wrote to memory of 4356	3756	4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
"C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
  "C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 544
      4⤵
      Program crash
      PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4356 -ip 4356
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3756-134-0x0000000000000000-mapping.dmp

Download
memory/3756-135-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3756-137-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3756-139-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4356-138-0x0000000000000000-mapping.dmp

Download
memory/4356-140-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads