kpot | 6e67ebd342080ea5f9021681d053408dcda5abde55ca5a5bb1e9515744694f89

General

Target

f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe
Size

1.3MB
MD5

f57e393d663546598fa95e6ae684b8c0
SHA1

3854af9798bcb901889a70e9a3fc4b2c6add4ead
SHA256

6e67ebd342080ea5f9021681d053408dcda5abde55ca5a5bb1e9515744694f89
SHA512

28c8e46da37825c47db2ea9024aedb73b09c7c81f775db67a51ca31b0ecbd56419d387cafd11b7493c656c1cc147ea9d4d1f0b7cea170ab3ff4914b1131cb0f1
SSDEEP

24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0n7:E5aIwC+Agr6twjVDO7

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/4272-15-0x0000000002210000-0x0000000002239000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

pid	process
4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

description	pid	process
Token: SeTcbPrivilege	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
Token: SeTcbPrivilege	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

pid	process
4272	f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe
4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exef68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe

description	pid	process	target process
PID 4272 wrote to memory of 4004	4272	f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
PID 4272 wrote to memory of 4004	4272	f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
PID 4272 wrote to memory of 4004	4272	f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4004 wrote to memory of 3432	4004	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 4760 wrote to memory of 2548	4760	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe
PID 2456 wrote to memory of 1532	2456	f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f57e393d663546598fa95e6ae684b8c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272

C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3432

C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:2548

C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\f68e393d773647699fa96e7ae794b9c0_NeikiAnalytict.exe
Filesize
1.3MB

MD5
f57e393d663546598fa95e6ae684b8c0

SHA1
3854af9798bcb901889a70e9a3fc4b2c6add4ead

SHA256
6e67ebd342080ea5f9021681d053408dcda5abde55ca5a5bb1e9515744694f89

SHA512
28c8e46da37825c47db2ea9024aedb73b09c7c81f775db67a51ca31b0ecbd56419d387cafd11b7493c656c1cc147ea9d4d1f0b7cea170ab3ff4914b1131cb0f1

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Filesize
27KB

MD5
d1a0e8fa4d6f8aa1546c0a018f7e9cf9

SHA1
f293cf886581573cd1e220a8bbaee5cc2bc9a9e8

SHA256
614466a61095e4fa07683626cafb6ada2e210ad4436d753b6408d39ab89afc80

SHA512
12be5097584e249aec32dad16e3adeb2c37a8a3450d369cbda0ce9edc41c2cc9d720425922c8fded019043a727ee6d9c7fbcde2e2251c92d29569d63bae83c79

Download Submit
memory/3432-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3432-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3432-51-0x0000023AA2A90000-0x0000023AA2A91000-memory.dmp

Filesize
4KB

Download
memory/4004-27-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-29-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4004-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4004-26-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-33-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-28-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/4004-30-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-31-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-32-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/4004-37-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-36-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-35-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4004-34-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4272-5-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-8-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-3-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-4-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-14-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-6-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-7-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-13-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-9-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-10-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4272-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4272-15-0x0000000002210000-0x0000000002239000-memory.dmp

Filesize
164KB

Download
memory/4272-11-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-12-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4272-2-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4760-58-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-61-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-62-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-60-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-64-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-65-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-66-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-69-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-68-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-67-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-63-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4760-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4760-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4760-59-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads