kronos | b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7 | Triage

Sharing

General

Target

b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7
Size

317KB
Sample

240624-k32kcavbma
MD5

83780e63f48cb21bea3e734857892bc1
SHA1

2dcd36b040a882756d85616edc92cacbdeaa4067
SHA256

b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7
SHA512

6ef619064cc2422051efa081446fa5545920a829bf080bd6362a20d4ccb459e9abcf7e8c8131c3e357b710e4730f49e3256e54d74f42d523f44bbaf8929cdc5b
SSDEEP

6144:haTKwZxUmcOf5Zht6W46r9YOz+RpXKr9qNRyk7kLDyqqiJ6n4+OUP7cu8hPIRDxC:wTtTUmhZr6q9NqDGDypiK5O9hjn

Score

10^/10

kronos banker botnet evasion persistence

Malware Config

Targets

- Target
  
  b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7
- Size
  
  317KB
- MD5
  
  83780e63f48cb21bea3e734857892bc1
- SHA1
  
  2dcd36b040a882756d85616edc92cacbdeaa4067
- SHA256
  
  b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7
- SHA512
  
  6ef619064cc2422051efa081446fa5545920a829bf080bd6362a20d4ccb459e9abcf7e8c8131c3e357b710e4730f49e3256e54d74f42d523f44bbaf8929cdc5b
- SSDEEP
  
  6144:haTKwZxUmcOf5Zht6W46r9YOz+RpXKr9qNRyk7kLDyqqiJ6n4+OUP7cu8hPIRDxC:wTtTUmhZr6q9NqDGDypiK5O9hjn
Score

10^/10

kronos banker botnet evasion persistence
- Kronos
  banker botnet kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetevasionpersistence

behavioral2

kronosbankerbotnetpersistence