kronos | 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166 | Triage

Sharing

General

Target

e8ab73bd31591fa5337be49241f8a7d8_JaffaCakes118
Size

314KB
Sample

241212-2w382asjfl
MD5

e8ab73bd31591fa5337be49241f8a7d8
SHA1

c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
SHA256

59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
SHA512

d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
SSDEEP

6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q

Score

10^/10

kronos banker botnet discovery evasion persistence

Malware Config

Targets

- Target
  
  e8ab73bd31591fa5337be49241f8a7d8_JaffaCakes118
- Size
  
  314KB
- MD5
  
  e8ab73bd31591fa5337be49241f8a7d8
- SHA1
  
  c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
- SHA256
  
  59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
- SHA512
  
  d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
- SSDEEP
  
  6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q
Score

10^/10

kronos banker botnet discovery evasion persistence
- Kronos
  banker botnet kronos
- Kronos family
  kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetdiscoveryevasionpersistence

behavioral2