kpot | d72cae7edcf9b178c61322680b03435b55c857822a7697be7c8b0c12b5c0d39c

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe
Size

1.3MB
MD5

9ae2dda7a7f3c71d10ae4f683c9725b0
SHA1

c24735701548a547f1c0215489a0423c9de36752
SHA256

d72cae7edcf9b178c61322680b03435b55c857822a7697be7c8b0c12b5c0d39c
SHA512

312b0508ab8f84b4ab2100619ae9fef0f8308e57fed815fe2a004fb3e4437f8ef5e853e66c4dd868a963e82d95eb59b854176e83c026932231c3b57f87d59351
SSDEEP

24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOrwwyDTWVoWMQvAGeOfO5JIWycr:E5aIwC+Agr6StVEnmcKrwwyGwSw3r

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023416-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4064-15-0x00000000022E0000-0x0000000002309000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
Token: SeTcbPrivilege	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4064	9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe
3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3700	4064	9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe	84
PID 4064 wrote to memory of 3700	4064	9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe	84
PID 4064 wrote to memory of 3700	4064	9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe	84
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 3700 wrote to memory of 3508	3700	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	85
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 2744 wrote to memory of 1836	2744	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	99
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108
PID 892 wrote to memory of 4036	892	9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ae2dda7a7f3c71d10ae4f683c9725b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3508

C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1836

C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\9ae2dda8a8f3c81d10ae4f793c9826b0_NeikiAnalytict.exe

Filesize
1.3MB

MD5
9ae2dda7a7f3c71d10ae4f683c9725b0

SHA1
c24735701548a547f1c0215489a0423c9de36752

SHA256
d72cae7edcf9b178c61322680b03435b55c857822a7697be7c8b0c12b5c0d39c

SHA512
312b0508ab8f84b4ab2100619ae9fef0f8308e57fed815fe2a004fb3e4437f8ef5e853e66c4dd868a963e82d95eb59b854176e83c026932231c3b57f87d59351

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
43KB

MD5
8799be4d7bfcc5c20be268630abc920e

SHA1
84b945ec14e17ece664185881c038e28cc732fec

SHA256
cc2d47578c4d2a079ebe18a669968f1344fb82c5424d870bb1977353a5a98947

SHA512
20f0b36527c92ef7ba6fa5d90d845e6b9f7695fa07ae4b66e2f8cec66c5fae86d1db5aa99614f323e9c355d885625deb3c878d536ac9d977b3e455e02f18ba4b

Download Submit
memory/2744-65-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-66-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-60-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-61-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-62-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-64-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-58-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-59-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2744-67-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2744-68-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-69-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2744-63-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/3508-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3508-51-0x000001FCD1710000-0x000001FCD1711000-memory.dmp

Filesize
4KB

Download
memory/3700-30-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-52-0x0000000003090000-0x000000000314E000-memory.dmp

Filesize
760KB

Download
memory/3700-34-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-33-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-32-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-31-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-53-0x0000000003150000-0x0000000003419000-memory.dmp

Filesize
2.8MB

Download
memory/3700-29-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-27-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-26-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3700-37-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3700-36-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-28-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/3700-35-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/4064-12-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-10-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-6-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-7-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-4-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-9-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-5-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-11-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-8-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-13-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-14-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4064-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4064-15-0x00000000022E0000-0x0000000002309000-memory.dmp

Filesize
164KB

Download
memory/4064-2-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4064-3-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download