kpot | 21e516d51c181024b685554ae22760bc59d0485e8dffaaa99322597844bf000e

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe
Size 1.1MB
Sample240508-njajasaa91
SHA256 21e516d51c181024b685554ae22760bc59d0485e8dffaaa99322597844bf000e
MD5 825fd4e7bacce35f9d3999a4c28c3c40
SHA1 56c582db4d568babbb70a60de6e475a54db9a2b7
SHA512 42a2ac455c080452bea89c4fa4b40b382f47cfedef4200849987633bf5da9b1c206b778333c22834b05ecebb2001889e80166d62c3a84122481b335801ab4d89
SSDEEP 24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf69Aso:E5aIwC+Agr6S/FEAGsji6x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b8a-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3396-15-0x0000000002AC0000-0x0000000002AE9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
Token: SeTcbPrivilege	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3396	825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe
1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1632	3396	825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe	83
PID 3396 wrote to memory of 1632	3396	825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe	83
PID 3396 wrote to memory of 1632	3396	825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe	83
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 1632 wrote to memory of 2984	1632	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	84
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 4744 wrote to memory of 844	4744	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	102
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115
PID 2032 wrote to memory of 4120	2032	926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2984

C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:844

C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe
Size 1.1MB
SHA256 21e516d51c181024b685554ae22760bc59d0485e8dffaaa99322597844bf000e
MD5 825fd4e7bacce35f9d3999a4c28c3c40
SHA1 56c582db4d568babbb70a60de6e475a54db9a2b7
SHA512 42a2ac455c080452bea89c4fa4b40b382f47cfedef4200849987633bf5da9b1c206b778333c22834b05ecebb2001889e80166d62c3a84122481b335801ab4d89
SSDEEP 24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf69Aso:E5aIwC+Agr6S/FEAGsji6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 67KB
SHA256 42d50c6055d284c672d566c0919432798efbab09d2d075b8351828c3ae37763d
MD5 0ab9e2cbecabbc157af46b187e6b801d
SHA1 8b47946539c24dc6e5a5349451b7a06a740e968a
SHA512 0452560ecfb7168b59f48944e816c91fa27afce355bd680631fa72d51b429929b3e2d07cfe903d9cde31c05049535edb673a67e514c577078ca62955db21b8f7
SSDEEP 768:tQytgz8chL66YVGoQzCCN30mhLqsstprn9KEidu1Eywqt6hVUoiqhKGYQVB3OlAv:MbZbn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1632-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1632-29-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-51-0x0000000003060000-0x000000000311E000-memory.dmp

Download

memory/1632-34-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-35-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-26-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-27-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-28-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/1632-36-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-30-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-31-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-32-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-33-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/1632-52-0x0000000003160000-0x0000000003429000-memory.dmp

Download

memory/1632-37-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/2984-53-0x000001871F2F0000-0x000001871F2F1000-memory.dmp

Download

memory/2984-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/2984-47-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/3396-2-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3396-15-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Download

memory/3396-14-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-3-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-4-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-13-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-6-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-7-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-8-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-9-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-10-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-11-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-12-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3396-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4744-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4744-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4744-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4744-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads