kpot | e1e9e74aecda0a4289de833724a957cc19ae6c6ffcf5a548491991de36aa2b6c

Analysis

max time kernel
136s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44a71764cdc5e937e3d65409bdd318a0_NEAS.exe
Size 1022KB
Sample240507-bpbbkabh61
SHA256 e1e9e74aecda0a4289de833724a957cc19ae6c6ffcf5a548491991de36aa2b6c
MD5 44a71764cdc5e937e3d65409bdd318a0
SHA1 f1405280b3c81d9f2c5ff6dfaafbde8440b757e0
SHA512 834c2323d2dd4cca77d00cad928a38230afc82b44204de0f87ba4fc6cdd491d9f1f23bc4699a741f0017041fa5396b4d74e64e20e2f20b93394de5c541164323
SSDEEP 12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVfIX3w:zQ5aILMCfmAUjzX6T0TlOnvPyQCfgA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b88-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4708-15-0x0000000002190000-0x00000000021B9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	4292	WerFault.exe	99

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
Token: SeTcbPrivilege	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4708	44a71764cdc5e937e3d65409bdd318a0_NEAS.exe
4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4804	4708	44a71764cdc5e937e3d65409bdd318a0_NEAS.exe	83
PID 4708 wrote to memory of 4804	4708	44a71764cdc5e937e3d65409bdd318a0_NEAS.exe	83
PID 4708 wrote to memory of 4804	4708	44a71764cdc5e937e3d65409bdd318a0_NEAS.exe	83
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4804 wrote to memory of 4752	4804	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	84
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 4292 wrote to memory of 3708	4292	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	100
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117
PID 3460 wrote to memory of 2708	3460	44a81874cdc6e938e3d76409bdd319a0_NFAS.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\44a71764cdc5e937e3d65409bdd318a0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\44a71764cdc5e937e3d65409bdd318a0_NEAS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4752

C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 712
  2⤵
  - Program crash
  PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4292 -ip 4292
1⤵
PID:4868

C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44a81874cdc6e938e3d76409bdd319a0_NFAS.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe
Size 1022KB
SHA256 e1e9e74aecda0a4289de833724a957cc19ae6c6ffcf5a548491991de36aa2b6c
MD5 44a71764cdc5e937e3d65409bdd318a0
SHA1 f1405280b3c81d9f2c5ff6dfaafbde8440b757e0
SHA512 834c2323d2dd4cca77d00cad928a38230afc82b44204de0f87ba4fc6cdd491d9f1f23bc4699a741f0017041fa5396b4d74e64e20e2f20b93394de5c541164323
SSDEEP 12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVfIX3w:zQ5aILMCfmAUjzX6T0TlOnvPyQCfgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 33KB
SHA256 0bae05a24f36abf2291a24832f08c74cd2aea2dd2975e4b1aa8195bb09db2032
MD5 568a4d73fd73e360ee8e18b52a7f2c7f
SHA1 ec7ef2e4e89acee15b95e63d91584e46c66c11d3
SHA512 f1f27a375bb1e6b640c6d470924d9e8ea0b7a5532e94fbb19923742f9cfdbcff79c2f9799428c9977da0d75ee4b2dda4e19a0566d344c461132cae89702ad64a
SSDEEP 768:OHn3AKDNyJxZL2xkpLg7PjJqIX2FfojB9ZP66ZtJ/3VHFymTN7Gasd5+ilv/getM:oHnAmh5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4292-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4292-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4292-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4292-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4708-15-0x0000000002190000-0x00000000021B9000-memory.dmp

Download

memory/4708-6-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-14-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-13-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4708-3-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-2-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-12-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-11-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-10-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-9-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-8-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-7-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4708-5-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4708-4-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4752-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/4752-51-0x00000211E0B10000-0x00000211E0B11000-memory.dmp

Download

memory/4752-48-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/4804-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-26-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-27-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-28-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-53-0x0000000003160000-0x0000000003429000-memory.dmp

Download

memory/4804-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-52-0x0000000003060000-0x000000000311E000-memory.dmp

Download

memory/4804-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4804-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4804-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4804-42-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4804-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads