kpot | 2e84c1b17cd02290036f9a53f626611ff3a435a512a622d53b807ebd264fd770

Analysis

max time kernel
135s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
Size

956KB
MD5

c594f8d0750dc5ee9ac98b0f32fa4c40
SHA1

c1f1c919bdb3182b469098c2489dec9bee6df494
SHA256

2e84c1b17cd02290036f9a53f626611ff3a435a512a622d53b807ebd264fd770
SHA512

d35e5f42f56bb8133b2fb528e353f5fea8ec8b6f6dd707c476a64f620b1eb5d59ef6f3ed2fac120ab2b7f33675c8b5b2c137ffae78033005853e94992665d3d5
SSDEEP

24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUkhmZc:E5aIwC+Agr6SNbq

Score

10^/10

kpot trickbot banker evasion execution stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001313f-20.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/2856-15-0x0000000000350000-0x0000000000379000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
2428	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe

Loads dropped DLL 2 IoCs

pid	Process
2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2816	sc.exe
2676	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeTcbPrivilege	1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
Token: SeTcbPrivilege	2428	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
2428	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1228	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 1228	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 1228	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 1228	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 2224	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2224	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2224	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2224	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2400	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2400	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2400	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2400	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2560	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2560	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2560	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2560	2856	c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe	34
PID 2224 wrote to memory of 2816	2224	cmd.exe	36
PID 2224 wrote to memory of 2816	2224	cmd.exe	36
PID 2224 wrote to memory of 2816	2224	cmd.exe	36
PID 2224 wrote to memory of 2816	2224	cmd.exe	36
PID 1228 wrote to memory of 2676	1228	cmd.exe	35
PID 1228 wrote to memory of 2676	1228	cmd.exe	35
PID 1228 wrote to memory of 2676	1228	cmd.exe	35
PID 1228 wrote to memory of 2676	1228	cmd.exe	35
PID 2400 wrote to memory of 2600	2400	cmd.exe	37
PID 2400 wrote to memory of 2600	2400	cmd.exe	37
PID 2400 wrote to memory of 2600	2400	cmd.exe	37
PID 2400 wrote to memory of 2600	2400	cmd.exe	37
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 2560 wrote to memory of 2712	2560	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	38
PID 1704 wrote to memory of 1028	1704	taskeng.exe	42
PID 1704 wrote to memory of 1028	1704	taskeng.exe	42
PID 1704 wrote to memory of 1028	1704	taskeng.exe	42
PID 1704 wrote to memory of 1028	1704	taskeng.exe	42
PID 1028 wrote to memory of 2288	1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	43
PID 1028 wrote to memory of 2288	1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	43
PID 1028 wrote to memory of 2288	1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	43
PID 1028 wrote to memory of 2288	1028	c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c594f8d0750dc5ee9ac98b0f32fa4c40_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2712

C:\Windows\system32\taskeng.exe
taskeng.exe {63B9771D-6044-4D4A-929D-9AD2050B0F4C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2288
- C:\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2428
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\WinSocket\c694f9d0860dc6ee9ac99b0f32fa4c40_NeikiAnalytict.exe

Filesize
956KB

MD5
c594f8d0750dc5ee9ac98b0f32fa4c40

SHA1
c1f1c919bdb3182b469098c2489dec9bee6df494

SHA256
2e84c1b17cd02290036f9a53f626611ff3a435a512a622d53b807ebd264fd770

SHA512
d35e5f42f56bb8133b2fb528e353f5fea8ec8b6f6dd707c476a64f620b1eb5d59ef6f3ed2fac120ab2b7f33675c8b5b2c137ffae78033005853e94992665d3d5

Download Submit
memory/2428-87-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2428-88-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2560-39-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-37-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-36-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-35-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-32-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-31-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-44-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2560-41-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-34-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-40-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-33-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-38-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2560-30-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2712-49-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2712-48-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2856-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2856-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-2-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2856-3-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-15-0x0000000000350000-0x0000000000379000-memory.dmp

Filesize
164KB

Download
memory/2856-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-11-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-12-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-9-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-10-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2856-8-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download