kpot | 5649ac66b6bba881528cfaea834559f33b22485be338b9f9c320e124b9a39fd3

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eaff92956b903c6aada9f749dce2360_NEAS.exe
Size

1.2MB
MD5

8eaff92956b903c6aada9f749dce2360
SHA1

f3fe9e15bf29c347880f093ad8cf1d3a6d7b2dea
SHA256

5649ac66b6bba881528cfaea834559f33b22485be338b9f9c320e124b9a39fd3
SHA512

b406f89291098887b4387c35efd2f1e2cdd4e12f276cef8b3eb24b465fe6d71a5713422155cc4673d150d3630f399f0e7995e90275461a6eed18c63913fd687b
SSDEEP

24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sdr36OTcgapChIwi0rfQ:E5aIwC+Agr6S/FEVpw

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b91-22.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4036-15-0x0000000002C20000-0x0000000002C49000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe
4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe
920	9eaff92967b903c7aada9f849dce2370_NFAS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe
Token: SeTcbPrivilege	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4036	8eaff92956b903c6aada9f749dce2360_NEAS.exe
2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe
4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe
920	9eaff92967b903c7aada9f849dce2370_NFAS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2252	4036	8eaff92956b903c6aada9f749dce2360_NEAS.exe	85
PID 4036 wrote to memory of 2252	4036	8eaff92956b903c6aada9f749dce2360_NEAS.exe	85
PID 4036 wrote to memory of 2252	4036	8eaff92956b903c6aada9f749dce2360_NEAS.exe	85
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 2252 wrote to memory of 3408	2252	9eaff92967b903c7aada9f849dce2370_NFAS.exe	86
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 4820 wrote to memory of 2044	4820	9eaff92967b903c7aada9f849dce2370_NFAS.exe	105
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114
PID 920 wrote to memory of 1756	920	9eaff92967b903c7aada9f849dce2370_NFAS.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8eaff92956b903c6aada9f749dce2360_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\8eaff92956b903c6aada9f749dce2360_NEAS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3408

C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2044

C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\9eaff92967b903c7aada9f849dce2370_NFAS.exe

Filesize
1.2MB

MD5
8eaff92956b903c6aada9f749dce2360

SHA1
f3fe9e15bf29c347880f093ad8cf1d3a6d7b2dea

SHA256
5649ac66b6bba881528cfaea834559f33b22485be338b9f9c320e124b9a39fd3

SHA512
b406f89291098887b4387c35efd2f1e2cdd4e12f276cef8b3eb24b465fe6d71a5713422155cc4673d150d3630f399f0e7995e90275461a6eed18c63913fd687b

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
15KB

MD5
4e6603717da6213fcffaa744bff428fb

SHA1
ad0519b1cb2659772ef9e80fa46b7f3d33b68167

SHA256
3315cbc0658d88218140154d2e3c89cb4671a71838e18d37e11847f3795f3f75

SHA512
287ef1972a475f1bf975ddd82454e769c73d2be427ad826d381aabb979823636ef4ce6ba383e991260c27834a6fedbdcfd11d168800085034274a7116bb54ead

Download Submit
memory/2252-32-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-28-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-34-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-36-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2252-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2252-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2252-35-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-26-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-52-0x00000000030A0000-0x000000000315E000-memory.dmp

Filesize
760KB

Download
memory/2252-29-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-30-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-31-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-33-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-53-0x0000000003160000-0x0000000003429000-memory.dmp

Filesize
2.8MB

Download
memory/2252-27-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2252-37-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/3408-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3408-51-0x00000221D91C0000-0x00000221D91C1000-memory.dmp

Filesize
4KB

Download
memory/4036-2-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-6-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4036-15-0x0000000002C20000-0x0000000002C49000-memory.dmp

Filesize
164KB

Download
memory/4036-4-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-3-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-5-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-14-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-7-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-8-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-9-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-10-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-11-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-12-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-13-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4036-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4820-58-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-68-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-67-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-66-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-65-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-64-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-63-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-62-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-61-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-60-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-59-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4820-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4820-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4820-69-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download