kpot | 128a127f6deb26474835911e0e07d7070a8355d927b3d6cff3dce1c86eb1d2e7

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8d361295b67905599f59c2357695950_NeikiAnalytics.exe
Size 1.1MB
Sample240516-ltv7msfc52
SHA256 128a127f6deb26474835911e0e07d7070a8355d927b3d6cff3dce1c86eb1d2e7
MD5 d8d361295b67905599f59c2357695950
SHA1 f123af9a572d744d56682a8f31c9d5fcbbffad73
SHA512 2e27416f604f8696da9e811f4ec56cec51becd49a7e4fb69885d760cd1f0f4baba6b790d3222aba7e7ecc2879e868777ae41c22c9d283687d302293d9e667b36
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMHI+rMUx+N43XVZpFyno:E5aIwC+Agr6StVEnmcI+2zTyno
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023418-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4660-15-0x0000000002180000-0x00000000021A9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
Token: SeTcbPrivilege	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4660	d8d361295b67905599f59c2357695950_NeikiAnalytics.exe
4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4012	4660	d8d361295b67905599f59c2357695950_NeikiAnalytics.exe	82
PID 4660 wrote to memory of 4012	4660	d8d361295b67905599f59c2357695950_NeikiAnalytics.exe	82
PID 4660 wrote to memory of 4012	4660	d8d361295b67905599f59c2357695950_NeikiAnalytics.exe	82
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 4012 wrote to memory of 3300	4012	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	83
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1592 wrote to memory of 2404	1592	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	100
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109
PID 1932 wrote to memory of 4312	1932	d9d371296b78906699f69c2368796960_NeikiAnalytict.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d8d361295b67905599f59c2357695950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d8d361295b67905599f59c2357695950_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3300

C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2404

C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d9d371296b78906699f69c2368796960_NeikiAnalytict.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\d9d371296b78906699f69c2368796960_NeikiAnalytict.exe
Size 1.1MB
SHA256 128a127f6deb26474835911e0e07d7070a8355d927b3d6cff3dce1c86eb1d2e7
MD5 d8d361295b67905599f59c2357695950
SHA1 f123af9a572d744d56682a8f31c9d5fcbbffad73
SHA512 2e27416f604f8696da9e811f4ec56cec51becd49a7e4fb69885d760cd1f0f4baba6b790d3222aba7e7ecc2879e868777ae41c22c9d283687d302293d9e667b36
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMHI+rMUx+N43XVZpFyno:E5aIwC+Agr6StVEnmcI+2zTyno
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 32KB
SHA256 141b7d5efdbf31e01e2aadfc372ac5bd4b65680f4cee07c4b2516d58a9ff2162
MD5 ceefe4215fedb7e9cd78161e2481c5f2
SHA1 53a07a86d1bd6491ad0319ad05aa992abddd11ad
SHA512 c2683955e2f69c450a8812084701adc37960fede5c536c6f9561e46781b7b577ad74b42b6911041a37a83d45f6e65d510c52e2c7c4ce360e4a2825918c437c49
SSDEEP 768:RMj7NJCg75/DUw1OZzDSbIv1+uvvEg8H+c19qF/lhPmlfVAA1+Ms161ZuCF1k1Oe:RMj7NJCg75/DUw1OZzDSbIv1+uvvEg8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1592-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1592-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/1592-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1592-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/3300-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/3300-51-0x000002082E850000-0x000002082E851000-memory.dmp

Download

memory/4012-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4012-52-0x00000000030C0000-0x000000000317E000-memory.dmp

Download

memory/4012-33-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-37-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-35-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-32-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-53-0x0000000003180000-0x0000000003449000-memory.dmp

Download

memory/4012-31-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-30-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-29-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-28-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-27-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-26-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-34-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-36-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/4012-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4660-4-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-5-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-3-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-7-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-8-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-9-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-2-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-10-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-12-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-11-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-6-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-13-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4660-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/4660-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4660-15-0x0000000002180000-0x00000000021A9000-memory.dmp

Download

memory/4660-14-0x0000000002140000-0x0000000002141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads