kpot | c3e2f91914fe166ea0a7130133fb6a3995d1b0985a56f963381f725a012ebef8

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe
Size 1.2MB
Sample240510-jam1taac8t
SHA256 c3e2f91914fe166ea0a7130133fb6a3995d1b0985a56f963381f725a012ebef8
MD5 a0de9b3b58834086c583bdbb8eea7810
SHA1 39bd7d28464291d3e72f01e16c262621c621ea5a
SHA512 af14e3a7d4ea8f061b764c7db9910b17ab0c589494ad403dee04f0c8fef3277a6bd46865f4b1c298da03606338b50901b4194e3110e2966e4ae4bfae812a4212
SSDEEP 24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0jxQ:E5aIwC+Agr6twjVDR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023431-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4812-15-0x0000000002270000-0x0000000002299000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
Token: SeTcbPrivilege	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4812	a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe
860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 860	4812	a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe	81
PID 4812 wrote to memory of 860	4812	a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe	81
PID 4812 wrote to memory of 860	4812	a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe	81
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 860 wrote to memory of 2196	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	82
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 4640 wrote to memory of 3984	4640	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	93
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96
PID 860 wrote to memory of 640	860	a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0de9b3b58834086c583bdbb8eea7810_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2196

C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3984

C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\a0de9b3b69934097c693bdbb9eea8910_NeikiAnalytict.exe
Size 1.2MB
SHA256 c3e2f91914fe166ea0a7130133fb6a3995d1b0985a56f963381f725a012ebef8
MD5 a0de9b3b58834086c583bdbb8eea7810
SHA1 39bd7d28464291d3e72f01e16c262621c621ea5a
SHA512 af14e3a7d4ea8f061b764c7db9910b17ab0c589494ad403dee04f0c8fef3277a6bd46865f4b1c298da03606338b50901b4194e3110e2966e4ae4bfae812a4212
SSDEEP 24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0jxQ:E5aIwC+Agr6twjVDR
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 29KB
SHA256 49b7d855c132a95ce775397fe119476e673011c33f9281a740c468927d1b4263
MD5 73d8cbd69df47144b8f8a47073e18769
SHA1 236769ef5b74c1c24e7d3fdb5fa10c1df5066a20
SHA512 d8822a8b43ff08f5da1cd13f79f2413da9eddb3cb5805ea3b8e6bcbfe756bde6992fa89572133a5e6f3e3254a069cca5951fb1c9734a83a7f2d10825314f485f
SSDEEP 768:FmKcUW3kddrOzS8u1Kf0ewf0p7jMuB6TNRZfJl4xWZ0lELV0D1yMZmtm3pPkHjEM:FmKcZ3knrOzZu1Kf0ewf0p7jMuB6TNRn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-32-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-28-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-34-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-35-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-36-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/860-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/860-26-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-27-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-51-0x0000000003060000-0x000000000311E000-memory.dmp

Download

memory/860-29-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-30-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-31-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-33-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/860-52-0x0000000003120000-0x00000000033E9000-memory.dmp

Download

memory/860-37-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/2196-47-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/2196-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/2196-53-0x0000028F9C020000-0x0000028F9C021000-memory.dmp

Download

memory/4640-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4640-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4640-58-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-61-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-62-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-63-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4640-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/4812-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-15-0x0000000002270000-0x0000000002299000-memory.dmp

Download

memory/4812-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4812-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/4812-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4812-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads