Overview

overview

10

Static

static

eb1ec377b6...ec.exe

windows7-x64

10

eb1ec377b6...ec.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eb1ec377b6809568adcbf2a32af82ce4ee9116328187c3e59180ea24106539ec.exe

  • Size

    231KB

  • MD5

    f780458c5331d4e58d09f9363e7f641d

  • SHA1

    0781cb65e390dade1110d0fe3e27caadd1dfd5da

  • SHA256

    eb1ec377b6809568adcbf2a32af82ce4ee9116328187c3e59180ea24106539ec

  • SHA512

    0106e722ae70e519192008c348d3cedf245f05225a22fce37c45619f51a52a1f8f9f51db849ba619d58112c24d08caeaf6db2fa5b41110e7b12298d6e4bf8ca1

  • SSDEEP

    6144:sa0eTLgMMHT7VTBqo0UxdgBzTLzAQ75lmIGLrDbLrDMdyFFNHe1/EhNzIjEfQqqb:sa00LIHTZTsaksh2EfVqnu

Score
10/10
kronosbankerbotnetevasionpersistence

Malware Config

Signatures

  • Kronos
    bankerbotnetkronos
  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb1ec377b6809568adcbf2a32af82ce4ee9116328187c3e59180ea24106539ec.exe
    "C:\Users\Admin\AppData\Local\Temp\eb1ec377b6809568adcbf2a32af82ce4ee9116328187c3e59180ea24106539ec.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/260-67-0x0000000000110000-0x0000000000115000-memory.dmp
    Filesize

    20KB

    Download
  • memory/276-86-0x0000000001BA0000-0x0000000001BA5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/284-76-0x0000000001390000-0x0000000001395000-memory.dmp
    Filesize

    20KB

    Download
  • memory/332-68-0x00000000007F0000-0x00000000007F5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/372-69-0x0000000000250000-0x0000000000255000-memory.dmp
    Filesize

    20KB

    Download
  • memory/384-70-0x00000000006E0000-0x00000000006E5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/420-71-0x0000000000240000-0x0000000000245000-memory.dmp
    Filesize

    20KB

    Download
  • memory/464-73-0x00000000000D0000-0x00000000000D5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/480-72-0x00000000009D0000-0x00000000009D5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/488-81-0x0000000000120000-0x0000000000125000-memory.dmp
    Filesize

    20KB

    Download
  • memory/548-66-0x00000000001A0000-0x00000000001A5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/548-59-0x0000000010000000-0x0000000010010000-memory.dmp
    Filesize

    64KB

    Download
  • memory/548-58-0x0000000000A90000-0x0000000000D11000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/548-57-0x00000000752C1000-0x00000000752C3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/548-55-0x0000000000000000-mapping.dmp
    Download
  • memory/584-82-0x0000000000460000-0x0000000000465000-memory.dmp
    Filesize

    20KB

    Download
  • memory/664-74-0x0000000000540000-0x0000000000545000-memory.dmp
    Filesize

    20KB

    Download
  • memory/748-83-0x0000000000880000-0x0000000000885000-memory.dmp
    Filesize

    20KB

    Download
  • memory/808-75-0x0000000000800000-0x0000000000805000-memory.dmp
    Filesize

    20KB

    Download
  • memory/844-84-0x0000000000180000-0x0000000000185000-memory.dmp
    Filesize

    20KB

    Download
  • memory/884-85-0x0000000000800000-0x0000000000805000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1052-78-0x00000000000F0000-0x00000000000F5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1084-87-0x0000000000090000-0x0000000000095000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1104-77-0x0000000001E60000-0x0000000001E65000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1184-88-0x00000000001A0000-0x00000000001A5000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1216-89-0x0000000002A20000-0x0000000002A25000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1680-79-0x0000000000100000-0x0000000000105000-memory.dmp
    Filesize

    20KB

    Download
  • memory/1808-54-0x0000000076171000-0x0000000076173000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2036-80-0x0000000000100000-0x0000000000105000-memory.dmp
    Filesize

    20KB

    Download