kronos | 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166 | Triage

Sharing

General

Target

59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
Size

314KB
Sample

221127-xsy3pabf78
MD5

e8ab73bd31591fa5337be49241f8a7d8
SHA1

c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
SHA256

59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
SHA512

d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
SSDEEP

6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q

Score

10^/10

kronos banker botnet persistence

Malware Config

Targets

- Target
  
  59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
- Size
  
  314KB
- MD5
  
  e8ab73bd31591fa5337be49241f8a7d8
- SHA1
  
  c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
- SHA256
  
  59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
- SHA512
  
  d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
- SSDEEP
  
  6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q
Score

10^/10

kronos banker botnet persistence
- Kronos
  banker botnet kronos
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetpersistence

behavioral2