kpot | 8d9dfc1f84f394250d90990b7bc92d81e670d51842a6930c358f6965db39bca1

Analysis

max time kernel
181s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.543b23a57515a6eded0f8491331407f0.exe
Size

967KB
MD5

543b23a57515a6eded0f8491331407f0
SHA1

ed5153e01179a0fc5fb3c2d0fde9822fc49cd22f
SHA256

8d9dfc1f84f394250d90990b7bc92d81e670d51842a6930c358f6965db39bca1
SHA512

415faaf9a5ae8221a3301d3a571066d6ad208e4d98bcda74f8f743d86e8425cd3293c5c94a0001c9024fee1cbd5f42de4c49167ca8e0b50039569a4f50aa9aa5
SSDEEP

24576:zQ5aILMCfmAUjzX6xQtpj/Yz6XVSvmHaZ0Lc:E5aIwC+Agr6St1lOqVo

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 4 IoCs

resource	yara_rule
behavioral2/files/0x0007000000022e50-22.dat	family_kpot
behavioral2/files/0x0007000000022e50-23.dat	family_kpot
behavioral2/files/0x0007000000022e50-60.dat	family_kpot
behavioral2/files/0x0007000000022e50-98.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 10 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4456-19-0x0000000002AC0000-0x0000000002AE9000-memory.dmp	trickbot_loader32
behavioral2/memory/4456-15-0x0000000002AC0000-0x0000000002AE9000-memory.dmp	trickbot_loader32
behavioral2/memory/4456-25-0x0000000002AC0000-0x0000000002AE9000-memory.dmp	trickbot_loader32
behavioral2/memory/2964-44-0x0000000002AD0000-0x0000000002AF9000-memory.dmp	trickbot_loader32
behavioral2/memory/2964-59-0x0000000002AD0000-0x0000000002AF9000-memory.dmp	trickbot_loader32
behavioral2/memory/1492-79-0x0000000000E50000-0x0000000000E79000-memory.dmp	trickbot_loader32
behavioral2/memory/1492-87-0x0000000000E50000-0x0000000000E79000-memory.dmp	trickbot_loader32
behavioral2/memory/1492-95-0x0000000000E50000-0x0000000000E79000-memory.dmp	trickbot_loader32
behavioral2/memory/1896-117-0x0000000000CB0000-0x0000000000CD9000-memory.dmp	trickbot_loader32
behavioral2/memory/1896-132-0x0000000000CB0000-0x0000000000CD9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2964	NFAS.543b23a57515a6eded0f8491331407f0.exe
1492	NFAS.543b23a57515a6eded0f8491331407f0.exe
1896	NFAS.543b23a57515a6eded0f8491331407f0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe
Token: SeTcbPrivilege	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4456	NEAS.543b23a57515a6eded0f8491331407f0.exe
2964	NFAS.543b23a57515a6eded0f8491331407f0.exe
1492	NFAS.543b23a57515a6eded0f8491331407f0.exe
1896	NFAS.543b23a57515a6eded0f8491331407f0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2964	4456	NEAS.543b23a57515a6eded0f8491331407f0.exe	90
PID 4456 wrote to memory of 2964	4456	NEAS.543b23a57515a6eded0f8491331407f0.exe	90
PID 4456 wrote to memory of 2964	4456	NEAS.543b23a57515a6eded0f8491331407f0.exe	90
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 2964 wrote to memory of 952	2964	NFAS.543b23a57515a6eded0f8491331407f0.exe	91
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1492 wrote to memory of 3060	1492	NFAS.543b23a57515a6eded0f8491331407f0.exe	109
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112
PID 1896 wrote to memory of 4836	1896	NFAS.543b23a57515a6eded0f8491331407f0.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.543b23a57515a6eded0f8491331407f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.543b23a57515a6eded0f8491331407f0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:952

C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3060

C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe

Filesize
967KB

MD5
543b23a57515a6eded0f8491331407f0

SHA1
ed5153e01179a0fc5fb3c2d0fde9822fc49cd22f

SHA256
8d9dfc1f84f394250d90990b7bc92d81e670d51842a6930c358f6965db39bca1

SHA512
415faaf9a5ae8221a3301d3a571066d6ad208e4d98bcda74f8f743d86e8425cd3293c5c94a0001c9024fee1cbd5f42de4c49167ca8e0b50039569a4f50aa9aa5

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe

Filesize
967KB

MD5
543b23a57515a6eded0f8491331407f0

SHA1
ed5153e01179a0fc5fb3c2d0fde9822fc49cd22f

SHA256
8d9dfc1f84f394250d90990b7bc92d81e670d51842a6930c358f6965db39bca1

SHA512
415faaf9a5ae8221a3301d3a571066d6ad208e4d98bcda74f8f743d86e8425cd3293c5c94a0001c9024fee1cbd5f42de4c49167ca8e0b50039569a4f50aa9aa5

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe

Filesize
967KB

MD5
543b23a57515a6eded0f8491331407f0

SHA1
ed5153e01179a0fc5fb3c2d0fde9822fc49cd22f

SHA256
8d9dfc1f84f394250d90990b7bc92d81e670d51842a6930c358f6965db39bca1

SHA512
415faaf9a5ae8221a3301d3a571066d6ad208e4d98bcda74f8f743d86e8425cd3293c5c94a0001c9024fee1cbd5f42de4c49167ca8e0b50039569a4f50aa9aa5

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.543b23a57515a6eded0f8491331407f0.exe

Filesize
967KB

MD5
543b23a57515a6eded0f8491331407f0

SHA1
ed5153e01179a0fc5fb3c2d0fde9822fc49cd22f

SHA256
8d9dfc1f84f394250d90990b7bc92d81e670d51842a6930c358f6965db39bca1

SHA512
415faaf9a5ae8221a3301d3a571066d6ad208e4d98bcda74f8f743d86e8425cd3293c5c94a0001c9024fee1cbd5f42de4c49167ca8e0b50039569a4f50aa9aa5

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
21KB

MD5
ce98f1aeb81f6fc5fad2a34e9bfb760f

SHA1
c0e1591111f60a7f4f34303c4e924717ee71ec32

SHA256
229e3a0772156bc5a2fdf2f51debe3711c17edf764081a1a5f400207b31c8340

SHA512
d948189e21167003648c24f4539e0fb4de021ec94547729633e612d67b9fb3f598ac3d5645fc8c41db49a9e9b943740f8054c86d2143a6166056dc711f70eac0

Download Submit
memory/952-53-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/952-52-0x0000024091690000-0x0000024091691000-memory.dmp

Filesize
4KB

Download
memory/1492-71-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-79-0x0000000000E50000-0x0000000000E79000-memory.dmp

Filesize
164KB

Download
memory/1492-64-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-65-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-67-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-68-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-95-0x0000000000E50000-0x0000000000E79000-memory.dmp

Filesize
164KB

Download
memory/1492-93-0x0000000001BC0000-0x0000000001C7E000-memory.dmp

Filesize
760KB

Download
memory/1492-87-0x0000000000E50000-0x0000000000E79000-memory.dmp

Filesize
164KB

Download
memory/1492-86-0x0000000001BA0000-0x0000000001BA1000-memory.dmp

Filesize
4KB

Download
memory/1492-80-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-66-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-78-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1492-75-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-74-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-73-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-72-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-69-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1492-70-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1896-117-0x0000000000CB0000-0x0000000000CD9000-memory.dmp

Filesize
164KB

Download
memory/1896-116-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1896-118-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1896-124-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1896-132-0x0000000000CB0000-0x0000000000CD9000-memory.dmp

Filesize
164KB

Download
memory/2964-31-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-59-0x0000000002AD0000-0x0000000002AF9000-memory.dmp

Filesize
164KB

Download
memory/2964-43-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-44-0x0000000002AD0000-0x0000000002AF9000-memory.dmp

Filesize
164KB

Download
memory/2964-46-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2964-50-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/2964-57-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/2964-39-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-28-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-29-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-58-0x0000000003160000-0x0000000003429000-memory.dmp

Filesize
2.8MB

Download
memory/2964-30-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-38-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-36-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-37-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-35-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-33-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-34-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-32-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2964-41-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4456-11-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-5-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-4-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-14-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-25-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Filesize
164KB

Download
memory/4456-2-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-9-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-15-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Filesize
164KB

Download
memory/4456-18-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-19-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Filesize
164KB

Download
memory/4456-16-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4456-6-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-12-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-8-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-10-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-13-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-3-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4456-7-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download