kpot | 022701bbf249bbfe8fec9f0889c1f745c284a725804b3caf4bf1c9f029b060d1

General

Target

a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe
Size

879KB
MD5

a726aa92056efdf89e2cfebccc2f08e0
SHA1

c62c8984aadc52e418e4d36282952215a6e28f06
SHA256

022701bbf249bbfe8fec9f0889c1f745c284a725804b3caf4bf1c9f029b060d1
SHA512

b94b53f726598159bdeefc6331eed1affa9849bdda01e4683f510802135fc0162c056e9f1fefd9138200ffcbead2925ecbbfebf03f4b0f929eaa0c69964f60bb
SSDEEP

24576:zQ5aILMCfmAUjzX6xQt+4EnpZgkJOSSkM:E5aIwC+Agr6StVEn0ksj

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3868-15-0x00000000022B0000-0x00000000022D9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

pid	process
1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

description	pid	process
Token: SeTcbPrivilege	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
Token: SeTcbPrivilege	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

pid	process
3868	a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe
1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exea827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe

description	pid	process	target process
PID 3868 wrote to memory of 1184	3868	a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
PID 3868 wrote to memory of 1184	3868	a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
PID 3868 wrote to memory of 1184	3868	a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1184 wrote to memory of 3760	1184	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1036 wrote to memory of 5072	1036	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe
PID 1340 wrote to memory of 384	1340	a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a726aa92056efdf89e2cfebccc2f08e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868

C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3760

C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:5072

C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\a827aa92067efdf99e2cfebccc2f09e0_NeikiAnalytict.exe
Filesize
879KB

MD5
a726aa92056efdf89e2cfebccc2f08e0

SHA1
c62c8984aadc52e418e4d36282952215a6e28f06

SHA256
022701bbf249bbfe8fec9f0889c1f745c284a725804b3caf4bf1c9f029b060d1

SHA512
b94b53f726598159bdeefc6331eed1affa9849bdda01e4683f510802135fc0162c056e9f1fefd9138200ffcbead2925ecbbfebf03f4b0f929eaa0c69964f60bb

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Filesize
24KB

MD5
f41e014ffb38078e12ed61f263c6abf3

SHA1
357c0f3a1be8b0106817e009c5925efa2f096066

SHA256
312f0cfe9da4fa22351a9fb1ed359210069485f0382402ecaa86d6bdcd92b234

SHA512
c6f33cd4b1bc612dd5f97f791479642ce92b206f4c1e152d6d483d5e1929dde2c06269410b78bf0ccb2b434dcd19ad8d17887666ee1ad9cbc47b96c7165b7095

Download Submit
memory/1036-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1036-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1036-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1036-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1184-31-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-52-0x0000000003070000-0x000000000312E000-memory.dmp

Filesize
760KB

Download
memory/1184-37-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-36-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-35-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-34-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-33-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-32-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-53-0x0000000003130000-0x00000000033F9000-memory.dmp

Filesize
2.8MB

Download
memory/1184-30-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-29-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-28-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-27-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-26-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1184-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1184-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3760-51-0x0000028638A80000-0x0000028638A81000-memory.dmp

Filesize
4KB

Download
memory/3760-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3868-8-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3868-4-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-5-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-6-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-7-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-14-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-2-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3868-3-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-15-0x00000000022B0000-0x00000000022D9000-memory.dmp

Filesize
164KB

Download
memory/3868-9-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-10-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-11-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-12-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3868-13-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads