kpot | 69718270f5e0366fa0ac9ad52469758aa9fc515c4abcd27e35f7e0fe2cb9739c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe
Size

1.2MB
MD5

002e3c7968f8913fa45b3ee470e102b0
SHA1

96bd453acf31bd5598ef78aa77c3540a0b2853cf
SHA256

69718270f5e0366fa0ac9ad52469758aa9fc515c4abcd27e35f7e0fe2cb9739c
SHA512

5463f0b1d26713324090debb9c54aa07f021baf42c8ee5e6773701be38d7e88e407116f2fe869c97641011a25f77a333f441fbc0f28d24a6646b3aea1fb5424e
SSDEEP

24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsA7svY3qbuoVikIXW5p:E5aIwC+Agr6SNv/Ikeop

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002343a-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4976-15-0x00000000021E0000-0x0000000002209000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
Token: SeTcbPrivilege	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4976	002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe
2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 2008	4976	002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe	84
PID 4976 wrote to memory of 2008	4976	002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe	84
PID 4976 wrote to memory of 2008	4976	002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe	84
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 2008 wrote to memory of 4156	2008	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	85
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 4412 wrote to memory of 1700	4412	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	109
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119
PID 1256 wrote to memory of 3000	1256	002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\002e3c7968f8913fa45b3ee470e102b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4156

C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1700

C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\002e3c8979f9913fa46b3ee480e102b0_NeikiAnalytict.exe

Filesize
1.2MB

MD5
002e3c7968f8913fa45b3ee470e102b0

SHA1
96bd453acf31bd5598ef78aa77c3540a0b2853cf

SHA256
69718270f5e0366fa0ac9ad52469758aa9fc515c4abcd27e35f7e0fe2cb9739c

SHA512
5463f0b1d26713324090debb9c54aa07f021baf42c8ee5e6773701be38d7e88e407116f2fe869c97641011a25f77a333f441fbc0f28d24a6646b3aea1fb5424e

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
43KB

MD5
91b72e9903e3daadcb399eaf85b4bce8

SHA1
04851457995851a698a5005ad226fc1341e11a85

SHA256
a0788db202bc4f154eb1ef2d4e5ed162aa9eb18f38088cfe8cdef00061dcde4d

SHA512
1e00aa99cf9d328b7cb1756cb46b714f81227008eef70746f9c9f74892e33eef6d78858cb8a8a2d31b6a3e005210ea72b80841c69fa10dd5ef1906fbc68a12c9

Download Submit
memory/2008-30-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-34-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-35-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-36-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-37-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-26-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-27-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-32-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-33-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-52-0x00000000030E0000-0x000000000319E000-memory.dmp

Filesize
760KB

Download
memory/2008-28-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2008-29-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-31-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2008-53-0x00000000031A0000-0x0000000003469000-memory.dmp

Filesize
2.8MB

Download
memory/2008-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4156-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4156-51-0x0000022647220000-0x0000022647221000-memory.dmp

Filesize
4KB

Download
memory/4156-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4412-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4412-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4412-58-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-61-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-62-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-63-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4412-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4976-15-0x00000000021E0000-0x0000000002209000-memory.dmp

Filesize
164KB

Download
memory/4976-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4976-5-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-3-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-2-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-14-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4976-4-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-13-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-12-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-11-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-10-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-9-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-8-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4976-6-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download