kpot | 806e488f31ed639c01054468ecce52608f4e54b0acac7cc1a408d1752175abfd

Analysis

max time kernel
136s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe
Size

1.1MB
MD5

902a5d6f5686611634ab13d6e141d0b0
SHA1

707b329fd60bcc9537004cdddc883760026fccdf
SHA256

806e488f31ed639c01054468ecce52608f4e54b0acac7cc1a408d1752175abfd
SHA512

fe053424c4c1ead3b69ef94735dc1b146823cb290e762e00fd065af9e3c259060301db78e4b71d7a9b7b2ba4d5662cb278ee846c523c1d3ac336a98db2601b1e
SSDEEP

24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSM6+9:E5aIwC+Agr6SNv

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023434-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1280-15-0x0000000002AF0000-0x0000000002B19000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
Token: SeTcbPrivilege	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1280	902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe
1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1612	1280	902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe	82
PID 1280 wrote to memory of 1612	1280	902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe	82
PID 1280 wrote to memory of 1612	1280	902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe	82
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 1612 wrote to memory of 4504	1612	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	83
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 2472 wrote to memory of 1452	2472	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	99
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109
PID 3636 wrote to memory of 3556	3636	902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\902a5d6f5686611634ab13d6e141d0b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4504

C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1452

C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\902a6d7f6797711734ab13d7e141d0b0_NeikiAnalytict.exe

Filesize
1.1MB

MD5
902a5d6f5686611634ab13d6e141d0b0

SHA1
707b329fd60bcc9537004cdddc883760026fccdf

SHA256
806e488f31ed639c01054468ecce52608f4e54b0acac7cc1a408d1752175abfd

SHA512
fe053424c4c1ead3b69ef94735dc1b146823cb290e762e00fd065af9e3c259060301db78e4b71d7a9b7b2ba4d5662cb278ee846c523c1d3ac336a98db2601b1e

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
43KB

MD5
e1792f7ad7dbadd8dd1630a9f4b1c711

SHA1
461230bbbbf861800c5cce74f740bca1c5ccad30

SHA256
40ba752b8cee62cc9bb22261434076aff8647abf40e140e8fd87fa45ab5ca930

SHA512
76b0b60ea895779d7e9feea176e5b80ec50d9c00be6a30424392fdf1b4571a4f87f3f2a2af871ca46ae09b6179324513a44d6c22ecf5e09b8c2731627869ac3a

Download Submit
memory/1280-12-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-14-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1280-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1280-15-0x0000000002AF0000-0x0000000002B19000-memory.dmp

Filesize
164KB

Download
memory/1280-13-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-11-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-10-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-9-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-8-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-7-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-6-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-5-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-4-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-3-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1280-2-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1612-28-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-36-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-37-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-35-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-34-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-33-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-32-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-31-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-30-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-29-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-27-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-26-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1612-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1612-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1612-51-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/1612-52-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/2472-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2472-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2472-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4504-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4504-53-0x0000017B96A30000-0x0000017B96A31000-memory.dmp

Filesize
4KB

Download