kpot | e5328e4e72482362708a388067b7cec0b23178996fc38cd7f9f35beab176a619

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe
Size

1.3MB
MD5

6e34064edba068cf98fd12a856bfb310
SHA1

ad228a20505478cc907c842d420154801f9cf3bc
SHA256

e5328e4e72482362708a388067b7cec0b23178996fc38cd7f9f35beab176a619
SHA512

fe1e95e6944ef3d75707377ef0b165b67b3f8ffad3fc9715318941623886ceb497a44e7e4d02d1958138d9e83dd26b74453544ecaf65159f1ce9c8320ed4b937
SSDEEP

24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0nP:E5aIwC+Agr6twjVDOP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233fc-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1492-15-0x00000000028D0000-0x00000000028F9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
Token: SeTcbPrivilege	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1492	6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe
1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1680	1492	6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe	83
PID 1492 wrote to memory of 1680	1492	6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe	83
PID 1492 wrote to memory of 1680	1492	6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe	83
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 1680 wrote to memory of 4632	1680	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	84
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 2912 wrote to memory of 4952	2912	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	100
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109
PID 3312 wrote to memory of 3224	3312	7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e34064edba068cf98fd12a856bfb310_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4632

C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4952

C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\7e34074edba079cf99fd12a967bfb310_NeikiAnalytict.exe

Filesize
1.3MB

MD5
6e34064edba068cf98fd12a856bfb310

SHA1
ad228a20505478cc907c842d420154801f9cf3bc

SHA256
e5328e4e72482362708a388067b7cec0b23178996fc38cd7f9f35beab176a619

SHA512
fe1e95e6944ef3d75707377ef0b165b67b3f8ffad3fc9715318941623886ceb497a44e7e4d02d1958138d9e83dd26b74453544ecaf65159f1ce9c8320ed4b937

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
36KB

MD5
c9a8b57b3ffc9f045facab16800a8597

SHA1
ffbf0ce03df6d70d2e4cb5f2f460953e6ce356b4

SHA256
77bff0b03051104bdcb263cb4a2397e9921b11056334eace0e46e985202d2f35

SHA512
0635c80d53e4f25ddf11c3189354d5f15848ca81e49ce654bfa6560ca0b6140ee4dcce33c9b52250857ef9a14b86d22b481fcf6f3a9563b8783bc2f9024e7c30

Download Submit
memory/1492-10-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-14-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1492-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1492-15-0x00000000028D0000-0x00000000028F9000-memory.dmp

Filesize
164KB

Download
memory/1492-13-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-12-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-11-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-4-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-3-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-9-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-8-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-7-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-6-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-5-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1492-2-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/1680-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1680-37-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-36-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1680-35-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-34-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-26-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-33-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-32-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-31-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-30-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-29-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-28-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-27-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1680-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/1680-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/2912-69-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-61-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-68-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-67-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-66-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-65-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-64-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-63-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-62-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-58-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-60-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-59-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2912-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2912-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4632-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4632-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4632-51-0x000001A9C12B0000-0x000001A9C12B1000-memory.dmp

Filesize
4KB

Download