kpot | ac3dced3a3bf92da02d09773c27c271b8c2aff0df7a15d3fb41f5d108c5c4037

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe
Size 1.1MB
Sample240519-se18nscd48
SHA256 ac3dced3a3bf92da02d09773c27c271b8c2aff0df7a15d3fb41f5d108c5c4037
MD5 dd807dd63976b9c4118d89a834250df0
SHA1 ec9c703b28ccf1831ca9ded01a48b7ab5c6cbf2f
SHA512 ed1ce1e577a6f1ab891b7dc1d0ccdaa76c913adcf925c7ccdc57fb45e14b80345057d4e7631cf2e25b1dbde7e8e258569e36ad1967db85a27590dcc64fd2e476
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlU+jcTWSRe98rL:E5aIwC+Agr6StVEnmcKxYj+ITWSMgL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002342e-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3912-15-0x0000000002380000-0x00000000023A9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
Token: SeTcbPrivilege	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe
2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2456	3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe	82
PID 3912 wrote to memory of 2456	3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe	82
PID 3912 wrote to memory of 2456	3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2352

C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3728

C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
Size 1.1MB
SHA256 ac3dced3a3bf92da02d09773c27c271b8c2aff0df7a15d3fb41f5d108c5c4037
MD5 dd807dd63976b9c4118d89a834250df0
SHA1 ec9c703b28ccf1831ca9ded01a48b7ab5c6cbf2f
SHA512 ed1ce1e577a6f1ab891b7dc1d0ccdaa76c913adcf925c7ccdc57fb45e14b80345057d4e7631cf2e25b1dbde7e8e258569e36ad1967db85a27590dcc64fd2e476
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlU+jcTWSRe98rL:E5aIwC+Agr6StVEnmcKxYj+ITWSMgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 57KB
SHA256 d54dcb754dcf0124a9742d98b0961d033ee645d5794cd9bb6baa02b508321e33
MD5 fb5f141669fad26a51056d706fdfb07e
SHA1 e3c3abea38120642f2b70b2d67b0c3a33de105f9
SHA512 8efd5309d0516aeef19be1b2569eb52582ece273a12957a76edaec25d82142f5fe47c40ca1fe7fcc50c23b5dbfe63ad9b3a7e6108027d1e6d7ab05c68da072ab
SSDEEP 768:vXX+NC6YNzhkamPksjV8hXLL+ThFqMGD6uu2eFbZtdNxOVBFWakwJaQtjGSJaXwZ:36pwAnV8Diyt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1944-66-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-63-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-69-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-68-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-67-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-65-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-73-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1944-64-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-62-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-72-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/1944-61-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-60-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-59-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/1944-58-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/2352-47-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/2352-51-0x00000184D93A0000-0x00000184D93A1000-memory.dmp

Download

memory/2352-46-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/2456-29-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-53-0x0000000003180000-0x0000000003449000-memory.dmp

Download

memory/2456-35-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-34-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-33-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-32-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-30-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-36-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-28-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-26-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-40-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2456-42-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/2456-41-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/2456-37-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-31-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-27-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2456-52-0x00000000030C0000-0x000000000317E000-memory.dmp

Download

memory/3912-9-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-10-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-15-0x0000000002380000-0x00000000023A9000-memory.dmp

Download

memory/3912-4-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-5-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-6-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-2-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-7-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-3-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-8-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-11-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-12-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-17-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/3912-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3912-13-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3912-14-0x0000000002360000-0x0000000002361000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads