kpot | 5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64 | Triage

Analysis

max time kernel
129s
max time network
143s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 03:21

Sharing

Report Analysis Logs

General

Target

5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe
Size

548KB
MD5

740c32cefac30c905f5fea06b473d412
SHA1

2a03f94397e8d063f9bfd45c56516242c72c71dd
SHA256

5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64
SHA512

3467cfa7bdb29c9dd74e64b659fbd384e2ad4df918b465153e77bb0420150b70199b8b99cb95e8484021301c3cbb82a539f1d778bc6c1252a14eb4297cebab6e

Score

10^/10

kpot stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1320-56-0x0000000000400000-0x000000000048E000-memory.dmp	family_kpot

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe

pid process

1320 5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe

pid process

1320 5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe

C:\Users\Admin\AppData\Local\Temp\5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe
"C:\Users\Admin\AppData\Local\Temp\5a8089cb7519c8667b31517b57432905472c262bd9277b05593e55a2b6517e64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1320-55-0x00000000003C0000-0x00000000003F3000-memory.dmp

Filesize
204KB

Download
memory/1320-56-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download