kpot | 27ed27d7a830b6262b48318686efbcecd9f8176748b160c6d9b139c7f2b36891

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe
Size 1.3MB
Sample240508-h2p4tabc23
SHA256 27ed27d7a830b6262b48318686efbcecd9f8176748b160c6d9b139c7f2b36891
MD5 0415e5e2b23e6c152fdfa69700f4e800
SHA1 d02ceb60693385ae19a49d734b3c2c532baa5cbb
SHA512 a2eb5ecad673ae8e485843a75e6b6140dd31277e13eaf35b99daa57930eabb07c1bdceb315f88f68fadf7a4646b40a67cebdf5c400aebb744e71d9f2034b0387
SSDEEP 24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQV:E5aIwC+Agr6twjVDQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b8c-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/2732-16-0x00000000022C0000-0x00000000022E9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
Token: SeTcbPrivilege	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2732	0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe
4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4684	2732	0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe	84
PID 2732 wrote to memory of 4684	2732	0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe	84
PID 2732 wrote to memory of 4684	2732	0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe	84
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 4684 wrote to memory of 5004	4684	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	85
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 3524 wrote to memory of 3444	3524	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	99
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112
PID 4040 wrote to memory of 3584	4040	0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\0415e5e2b23e6c152fdfa69700f4e800_NEIKI.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:5004

C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3444

C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\0416e6e2b23e7c162fdfa79800f4e900_NFJLJ.exe
Size 1.3MB
SHA256 27ed27d7a830b6262b48318686efbcecd9f8176748b160c6d9b139c7f2b36891
MD5 0415e5e2b23e6c152fdfa69700f4e800
SHA1 d02ceb60693385ae19a49d734b3c2c532baa5cbb
SHA512 a2eb5ecad673ae8e485843a75e6b6140dd31277e13eaf35b99daa57930eabb07c1bdceb315f88f68fadf7a4646b40a67cebdf5c400aebb744e71d9f2034b0387
SSDEEP 24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQV:E5aIwC+Agr6twjVDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 27KB
SHA256 c025cb01593c213bdefd6ef6fa9fb3cbb7e0c4213fa37723c29f0d4f403da828
MD5 752a24a6769adea5f468deb72e730a3e
SHA1 b77bec9b8aa32c26003f8d515909139a3ddbf433
SHA512 f73469b15e7bf1c96086e72f557027162e010e47c082c562deb57a256a32dc4cc3004529620aae85b3fce8bd5639838534b63ee90136931c4e68471f23e27b7d
SSDEEP 192:1UtPtc9jiFcfhjKriq5Emb4++HGqxYN6Iy45t1BbKsuQGN7UHL9wbZ:mVtc97JA5EfJmr6IJ5t1IsmUHO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2732-8-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-6-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-12-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-11-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-10-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-9-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-4-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-13-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-5-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-3-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-2-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/2732-16-0x00000000022C0000-0x00000000022E9000-memory.dmp

Download

memory/2732-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2732-14-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2732-7-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/3524-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3524-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/3524-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3524-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/4684-53-0x0000000003160000-0x0000000003429000-memory.dmp

Download

memory/4684-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-27-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-26-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4684-42-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4684-52-0x0000000003060000-0x000000000311E000-memory.dmp

Download

memory/4684-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-28-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/4684-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4684-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/5004-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/5004-51-0x0000015A67390000-0x0000015A67391000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads