kpot | 065c5a58fda3891a107fc06dfcc7927e67646f0f5ac27f052bfdbd4ecce0257f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe
Size 1.1MB
Sample240508-dep33she62
SHA256 065c5a58fda3891a107fc06dfcc7927e67646f0f5ac27f052bfdbd4ecce0257f
MD5 b0600586fc73f66cf4c5f4024c842ec0
SHA1 d0419f487fda110bb383b48732c2c5b8af0ac9bf
SHA512 8770a43e6b28c93083985ae92fd1ff03f915ee12b5e18798e5f36e06283a54b362a2cc8e0e4f7b3a4d83c3a2584fb8f719036ae194ce720cc49294c9b6289000
SSDEEP 24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/ZcnDP7:E5aIwC+Agr6S/FFC+L7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bb6-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1940-15-0x0000000002200000-0x0000000002229000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
Token: SeTcbPrivilege	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1940	b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe
2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2188	1940	b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe	83
PID 1940 wrote to memory of 2188	1940	b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe	83
PID 1940 wrote to memory of 2188	1940	b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe	83
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 2188 wrote to memory of 4448	2188	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	84
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 1804 wrote to memory of 2952	1804	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	101
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109
PID 4896 wrote to memory of 2756	4896	b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b0600586fc73f66cf4c5f4024c842ec0_NEIKI.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4448

C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2952

C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\b0700697fc83f77cf4c6f4024c942ec0_NFJLJ.exe
Size 1.1MB
SHA256 065c5a58fda3891a107fc06dfcc7927e67646f0f5ac27f052bfdbd4ecce0257f
MD5 b0600586fc73f66cf4c5f4024c842ec0
SHA1 d0419f487fda110bb383b48732c2c5b8af0ac9bf
SHA512 8770a43e6b28c93083985ae92fd1ff03f915ee12b5e18798e5f36e06283a54b362a2cc8e0e4f7b3a4d83c3a2584fb8f719036ae194ce720cc49294c9b6289000
SSDEEP 24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/ZcnDP7:E5aIwC+Agr6S/FFC+L7
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 35KB
SHA256 a8465a0390a2ee77662a154ac55657c21a0f55e1311ddcc98205a5899ec56c42
MD5 d0798ba15980687f02678721f81818e5
SHA1 986e3a4815c2515c194c240ca9082f759d049ad1
SHA512 7e1186ecd31cad7b7b244e7447eca59f6fdb9440baf067b090707677b4e34584d094613b16b1a4fcd29d264ee7215de73fcc070ebe993c921566b1174ac503dd
SSDEEP 384:txlIf/ytmT9Zfcneo7iXmVYMGgvMg1F/nW0glgFIoYoNO/MKgPXgvEuDl14Gk:tuhXmyCk/cPw8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1804-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1804-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/1804-58-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-60-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-61-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-62-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-63-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-64-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-65-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-66-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-67-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-68-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1804-69-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1940-14-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-10-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-6-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-4-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-3-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-2-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-8-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-7-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-9-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/1940-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1940-15-0x0000000002200000-0x0000000002229000-memory.dmp

Download

memory/1940-12-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-13-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-5-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/1940-11-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/2188-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2188-53-0x0000000003160000-0x0000000003429000-memory.dmp

Download

memory/2188-52-0x00000000030A0000-0x000000000315E000-memory.dmp

Download

memory/2188-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/2188-42-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4448-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/4448-51-0x000001F490EE0000-0x000001F490EE1000-memory.dmp

Download

memory/4448-47-0x0000000010000000-0x000000001001E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads