kpot | 4851fd8ee24be02fc91f6f5ce0129345d1da140e9e83a79484ea5f7e6d5ea0a8

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe
Size

1.3MB
MD5

1a81d67997dc851d50a44efbfac7fb20
SHA1

6a7def632db11385b482858f8a458ba21e33c9ac
SHA256

4851fd8ee24be02fc91f6f5ce0129345d1da140e9e83a79484ea5f7e6d5ea0a8
SHA512

8bf3904ca65f9743636f8d9ea400928bd4ebcf028e9c445d1d70965b2136eba6b92c2ad928ed1b63a74e35aa053ab6da748fd14d2289957e30036514299dc1fc
SSDEEP

24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQN:E5aIwC+Agr6twjVD4

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002323e-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/648-16-0x0000000002230000-0x0000000002259000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
Token: SeTcbPrivilege	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
648	1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe
676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 676	648	1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe	90
PID 648 wrote to memory of 676	648	1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe	90
PID 648 wrote to memory of 676	648	1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe	90
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 676 wrote to memory of 2028	676	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	91
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 1612 wrote to memory of 4300	1612	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	102
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104
PID 3152 wrote to memory of 4472	3152	1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1a81d67997dc851d50a44efbfac7fb20_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:972

C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4300

C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\1a91d78998dc961d60a44efbfac8fb20_NeikiAnalytict.exe

Filesize
1.3MB

MD5
1a81d67997dc851d50a44efbfac7fb20

SHA1
6a7def632db11385b482858f8a458ba21e33c9ac

SHA256
4851fd8ee24be02fc91f6f5ce0129345d1da140e9e83a79484ea5f7e6d5ea0a8

SHA512
8bf3904ca65f9743636f8d9ea400928bd4ebcf028e9c445d1d70965b2136eba6b92c2ad928ed1b63a74e35aa053ab6da748fd14d2289957e30036514299dc1fc

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
39KB

MD5
dfa1349c6279594950cac4cde426fa33

SHA1
be1e567ff21a4a23ccecd0082a816eab219a4810

SHA256
12936e8e317cc164ba273b93f62bfab9b21c202f72a44a2edff67c26f55fa253

SHA512
73f67d1a89400aa47384586ce9d1dc968453fb37c4b8a46a12888d67e5b5aac721bb84a03efa41f04abc4c10309d6b4bf285dc525d5da4513894e102b36e06de

Download Submit
memory/648-6-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-9-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-8-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-7-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-5-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-13-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-14-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-12-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-11-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-10-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-4-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-3-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-2-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/648-15-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/648-16-0x0000000002230000-0x0000000002259000-memory.dmp

Filesize
164KB

Download
memory/648-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/676-27-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-32-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-31-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-30-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-29-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-28-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-33-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-26-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-37-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-36-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-35-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-34-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/676-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/676-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/676-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/676-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/1612-61-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-66-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-62-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-64-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-63-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-65-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-67-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-68-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-69-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-60-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-59-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-58-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1612-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1612-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2028-51-0x00000226AC440000-0x00000226AC441000-memory.dmp

Filesize
4KB

Download
memory/2028-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2028-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download