Overview

overview

10

Static

static

10

69e1ad9bb2...cs.exe

windows7-x64

10

69e1ad9bb2...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69e1ad9bb237c3ea4d588f7544a6a040_NeikiAnalytics.exe

  • Size

    1.2MB

  • Sample

    240518-brvszsde2v

  • MD5

    69e1ad9bb237c3ea4d588f7544a6a040

  • SHA1

    609e5538001198cfafc1e91263ab490a38f0d5cb

  • SHA256

    72d9a70566cb8ecca8b86971b2fb3c33737f38ec4321c949d5fefab2bdba6fc5

  • SHA512

    5ae33f01e1c8a1f4b588e5d8d480f4c253e564e55277cff8dad2af7f978f36ae84a6536c746f63ad234af5a60c0c741441229b7d093292afb5eceddb840cb0f5

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwQREr0PY:E5aIwC+Agr6S/FEAGsjiIIbErYY

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      69e1ad9bb237c3ea4d588f7544a6a040_NeikiAnalytics.exe

    • Size

      1.2MB

    • MD5

      69e1ad9bb237c3ea4d588f7544a6a040

    • SHA1

      609e5538001198cfafc1e91263ab490a38f0d5cb

    • SHA256

      72d9a70566cb8ecca8b86971b2fb3c33737f38ec4321c949d5fefab2bdba6fc5

    • SHA512

      5ae33f01e1c8a1f4b588e5d8d480f4c253e564e55277cff8dad2af7f978f36ae84a6536c746f63ad234af5a60c0c741441229b7d093292afb5eceddb840cb0f5

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwQREr0PY:E5aIwC+Agr6S/FEAGsjiIIbErYY

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks