kronos | c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

c911931abc...f9.exe

windows7-x64

c911931abc...f9.exe

windows10-2004-x64

Sharing

General

Target

c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9
Size

221KB
Sample

221126-h8nvbsbh28
MD5

596750f8bc7c1b8d15e2ed18995cb167
SHA1

a3adcd5f65d303a566206696ab4b02150a9ecc97
SHA256

c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9
SHA512

72f3ffde1db036fbdf1cbfabc5d7dd84f284f1607f60b9e8756be4106217a8cf1db003e3dbf86f9a593dea6f36f8c130eccfe662ef43514e64d327dd3ed282fb
SSDEEP

6144:pwHys8jsO3Mor+1MfgdCVtoAmNS3MECTphNDv3:SqsOTrEouCVtoq8ECTphN/

Score

10^/10

kronos banker botnet persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9.exe

Resource

win7-20221111-en

kronos banker botnet persistence

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9.exe

Resource

win10v2004-20220901-en

kronos banker botnet persistence

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9
- Size
  
  221KB
- MD5
  
  596750f8bc7c1b8d15e2ed18995cb167
- SHA1
  
  a3adcd5f65d303a566206696ab4b02150a9ecc97
- SHA256
  
  c911931abc119b6cc53a934ba0ea7da27a10aa19cf898fb82607ea7f057175f9
- SHA512
  
  72f3ffde1db036fbdf1cbfabc5d7dd84f284f1607f60b9e8756be4106217a8cf1db003e3dbf86f9a593dea6f36f8c130eccfe662ef43514e64d327dd3ed282fb
- SSDEEP
  
  6144:pwHys8jsO3Mor+1MfgdCVtoAmNS3MECTphNDv3:SqsOTrEouCVtoq8ECTphN/
Score

10^/10

kronos banker botnet persistence
- Kronos
  banker botnet kronos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetpersistence

behavioral2

kronosbankerbotnetpersistence

© 2018-2025

Terms | Privacy