kpot | ac3dced3a3bf92da02d09773c27c271b8c2aff0df7a15d3fb41f5d108c5c4037

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe
Size

1.1MB
MD5

dd807dd63976b9c4118d89a834250df0
SHA1

ec9c703b28ccf1831ca9ded01a48b7ab5c6cbf2f
SHA256

ac3dced3a3bf92da02d09773c27c271b8c2aff0df7a15d3fb41f5d108c5c4037
SHA512

ed1ce1e577a6f1ab891b7dc1d0ccdaa76c913adcf925c7ccdc57fb45e14b80345057d4e7631cf2e25b1dbde7e8e258569e36ad1967db85a27590dcc64fd2e476
SSDEEP

24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlU+jcTWSRe98rL:E5aIwC+Agr6StVEnmcKxYj+ITWSMgL

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002342e-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3912-15-0x0000000002380000-0x00000000023A9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
Token: SeTcbPrivilege	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe
2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2456	3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe	82
PID 3912 wrote to memory of 2456	3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe	82
PID 3912 wrote to memory of 2456	3912	dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 2456 wrote to memory of 2352	2456	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	84
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 1944 wrote to memory of 3728	1944	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	100
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109
PID 812 wrote to memory of 1164	812	dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dd807dd63976b9c4118d89a834250df0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2352

C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3728

C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\dd908dd73987b9c4119d99a934260df0_NeikiAnalytict.exe

Filesize
1.1MB

MD5
dd807dd63976b9c4118d89a834250df0

SHA1
ec9c703b28ccf1831ca9ded01a48b7ab5c6cbf2f

SHA256
ac3dced3a3bf92da02d09773c27c271b8c2aff0df7a15d3fb41f5d108c5c4037

SHA512
ed1ce1e577a6f1ab891b7dc1d0ccdaa76c913adcf925c7ccdc57fb45e14b80345057d4e7631cf2e25b1dbde7e8e258569e36ad1967db85a27590dcc64fd2e476

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
57KB

MD5
fb5f141669fad26a51056d706fdfb07e

SHA1
e3c3abea38120642f2b70b2d67b0c3a33de105f9

SHA256
d54dcb754dcf0124a9742d98b0961d033ee645d5794cd9bb6baa02b508321e33

SHA512
8efd5309d0516aeef19be1b2569eb52582ece273a12957a76edaec25d82142f5fe47c40ca1fe7fcc50c23b5dbfe63ad9b3a7e6108027d1e6d7ab05c68da072ab

Download Submit
memory/1944-66-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-63-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-69-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-68-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-67-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-65-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1944-64-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-62-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1944-61-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-60-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-59-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1944-58-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/2352-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2352-51-0x00000184D93A0000-0x00000184D93A1000-memory.dmp

Filesize
4KB

Download
memory/2352-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2456-29-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-53-0x0000000003180000-0x0000000003449000-memory.dmp

Filesize
2.8MB

Download
memory/2456-35-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-34-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-33-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-32-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-30-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-36-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-28-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-26-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2456-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2456-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2456-37-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-31-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-27-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2456-52-0x00000000030C0000-0x000000000317E000-memory.dmp

Filesize
760KB

Download
memory/3912-9-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-7-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-15-0x0000000002380000-0x00000000023A9000-memory.dmp

Filesize
164KB

Download
memory/3912-4-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-3-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-6-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-2-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-8-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-5-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-10-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-11-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-12-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3912-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3912-13-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3912-14-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download