kpot | 6d9b4aa3db13f35b244872ea096a697ffd0c4b0edcde09833a78414a0c9a7eeb

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe
Size

958KB
MD5

77223bc7f0c5f963fe2feac5acd6dd00
SHA1

f6aa05c93cb026a39dcffd5696f0b90b9356b5ec
SHA256

6d9b4aa3db13f35b244872ea096a697ffd0c4b0edcde09833a78414a0c9a7eeb
SHA512

82a25cddd7d35f25c40ce57459a93df706fd0bb78da94e1a749e53377c4e2627fcd8ab2db69e3ea03453ea51e0c387b79e61574d5c3f53b3397fb1171108fdd4
SSDEEP

24576:zQ5aILMCfmAUjzX6gfU1pjwjbsmQdmT1sens:E5aIwC+Agr6g81pbMs

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023432-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/5052-15-0x0000000002FE0000-0x0000000003009000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
Token: SeTcbPrivilege	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5052	77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe
4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4640	5052	77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe	82
PID 5052 wrote to memory of 4640	5052	77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe	82
PID 5052 wrote to memory of 4640	5052	77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe	82
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 4640 wrote to memory of 1540	4640	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	83
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 1496 wrote to memory of 4772	1496	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	101
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110
PID 2284 wrote to memory of 4456	2284	88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77223bc7f0c5f963fe2feac5acd6dd00_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1540

C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4772

C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\88223bc8f0c6f973fe2feac6acd7dd00_NeikiAnalytict.exe

Filesize
958KB

MD5
77223bc7f0c5f963fe2feac5acd6dd00

SHA1
f6aa05c93cb026a39dcffd5696f0b90b9356b5ec

SHA256
6d9b4aa3db13f35b244872ea096a697ffd0c4b0edcde09833a78414a0c9a7eeb

SHA512
82a25cddd7d35f25c40ce57459a93df706fd0bb78da94e1a749e53377c4e2627fcd8ab2db69e3ea03453ea51e0c387b79e61574d5c3f53b3397fb1171108fdd4

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
23KB

MD5
b307c0b664381cbab15d9e6e2622511c

SHA1
64e881fe0088cd264f0d540fbc4539437faaeec5

SHA256
c7fff4386f0351693f8094bff27475ce52380430b871490e77581c9d190b404a

SHA512
97075eeafc5ccf5a31132c01f34c9e6118ef0bcb8c8896d9871598066758a89f1fc082216416e66af1db02fb96e2101b4ba0cba3ecc80f1bd2196290e72ccfa1

Download Submit
memory/1496-62-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-65-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-58-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-59-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-60-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-61-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1496-63-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-64-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1496-66-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-67-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-68-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1496-69-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1540-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1540-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1540-51-0x0000021A796F0000-0x0000021A796F1000-memory.dmp

Filesize
4KB

Download
memory/4640-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/4640-27-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/4640-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4640-26-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-37-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-36-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-35-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-34-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-33-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-32-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-31-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-30-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-29-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-28-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4640-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/5052-7-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-4-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/5052-15-0x0000000002FE0000-0x0000000003009000-memory.dmp

Filesize
164KB

Download
memory/5052-6-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-3-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/5052-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-2-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-8-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-9-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-10-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-11-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-12-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-13-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/5052-14-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download