kronos | 9b5ce6709918eb68c83c2c6fb188770852f0ee4463531d65d175ce9100bc1342 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

92f41793668b39e40b15e613178ef72e_JaffaCakes118
Size

276KB
Sample

240603-3axd2acf9y
MD5

92f41793668b39e40b15e613178ef72e
SHA1

c8830e3fd414ca3c96417b19317bbc29baee7813
SHA256

9b5ce6709918eb68c83c2c6fb188770852f0ee4463531d65d175ce9100bc1342
SHA512

36faeabc755ef89a0594d3569142c9663f7351801f624b5ffebc9b9c7922afd3b5857eac8b7ef53a163bcd19743754ff019135bac00d25b904b2dbcaf7d26491
SSDEEP

6144:EaOh5fUVLxZzDJ6sikTBqKCEudJldVynNHbh/2z3+zTLWAQwv5lmYLrDKLrD6Kl:LOh5fELvDJ6sfTsKCEAzIVKlvrTpFOWK

Score

10^/10

kronos banker botnet evasion persistence

Malware Config

Targets

- Target
  
  92f41793668b39e40b15e613178ef72e_JaffaCakes118
- Size
  
  276KB
- MD5
  
  92f41793668b39e40b15e613178ef72e
- SHA1
  
  c8830e3fd414ca3c96417b19317bbc29baee7813
- SHA256
  
  9b5ce6709918eb68c83c2c6fb188770852f0ee4463531d65d175ce9100bc1342
- SHA512
  
  36faeabc755ef89a0594d3569142c9663f7351801f624b5ffebc9b9c7922afd3b5857eac8b7ef53a163bcd19743754ff019135bac00d25b904b2dbcaf7d26491
- SSDEEP
  
  6144:EaOh5fUVLxZzDJ6sikTBqKCEudJldVynNHbh/2z3+zTLWAQwv5lmYLrDKLrD6Kl:LOh5fELvDJ6sfTsKCEAzIVKlvrTpFOWK
Score

10^/10

kronos banker botnet evasion persistence
- Kronos
  banker botnet kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetevasionpersistence

behavioral2

kronosbankerbotnetpersistence