kpot | a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe
Size

1.6MB
MD5

0b54440728c218b809c865efde2be968
SHA1

620c868da0e65cf15bd0fc9ba1bf5dfe8221a5a8
SHA256

a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744
SHA512

84108b95a985bd8cddccb121707c02c7d471da0d3cfc02e4b5963e126c40f5d97f8e42258b05d26b3510dd7d1aac91cc0807b6ba4b7079b518d6e8114bd14040
SSDEEP

24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/BxL+XKHZjb//8ISgH4:E5aIwC+Agr6SqCPGC6HZkIT/b/U

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023418-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3616-15-0x0000000002180000-0x00000000021A9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
Token: SeTcbPrivilege	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3616	a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe
4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4880	3616	a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe	83
PID 3616 wrote to memory of 4880	3616	a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe	83
PID 3616 wrote to memory of 4880	3616	a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe	83
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4880 wrote to memory of 3508	4880	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	84
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 4792 wrote to memory of 3664	4792	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	100
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109
PID 1540 wrote to memory of 4016	1540	a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe
"C:\Users\Admin\AppData\Local\Temp\a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3508

C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3664

C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\a69a892833994073d09ece9fa86c99e8cdfe6d0c1bb0d6a1f4ef203ff6b70844.exe

Filesize
1.6MB

MD5
0b54440728c218b809c865efde2be968

SHA1
620c868da0e65cf15bd0fc9ba1bf5dfe8221a5a8

SHA256
a58a792733884063d08ece9fa75c99e7cdfe5d0c1bb0d5a1f4ef203ff5b60744

SHA512
84108b95a985bd8cddccb121707c02c7d471da0d3cfc02e4b5963e126c40f5d97f8e42258b05d26b3510dd7d1aac91cc0807b6ba4b7079b518d6e8114bd14040

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
61KB

MD5
843165d8e3a68cf997e17fceaff743b1

SHA1
0c726014ae828bef536e2e8250aa6113c5cd15ea

SHA256
afb3b6b0d0257fddc709dc3032ba9cb42ca8d6ccf92ee1d08c652024bdaefeae

SHA512
d5182283898e89b56c01a99a9675c70c03ff0dfba3df7d95afa77e9ed7fa4b12924f7865332e8f5f7b2f6692500d74f0397d1a0b9d291dd0dcc5de6b2ccb2a33

Download Submit
memory/3508-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3508-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3508-51-0x0000020E26760000-0x0000020E26761000-memory.dmp

Filesize
4KB

Download
memory/3616-5-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-3-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-10-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-9-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-6-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-12-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-4-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-11-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-2-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3616-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3616-13-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-14-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-8-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/3616-15-0x0000000002180000-0x00000000021A9000-memory.dmp

Filesize
164KB

Download
memory/3616-7-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/4792-67-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-69-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4792-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4792-58-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-60-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-61-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-59-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-62-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-63-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-64-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-65-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-66-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4792-68-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4880-31-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4880-52-0x0000000003070000-0x000000000312E000-memory.dmp

Filesize
760KB

Download
memory/4880-26-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-36-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-27-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-28-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-29-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-30-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-53-0x0000000003170000-0x0000000003439000-memory.dmp

Filesize
2.8MB

Download
memory/4880-32-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-33-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-34-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-35-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4880-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4880-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4880-37-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download