Overview

overview

10

Static

static

10

79def490bc...cs.exe

windows7-x64

10

79def490bc...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe

  • Size

    1.1MB

  • Sample

    240524-2x9gfaed88

  • MD5

    79def490bc257c50acbd8d39ba3c3dd0

  • SHA1

    0eecd42d71af1b81d8492586aee7d45cf668adef

  • SHA256

    4a78768ec0773d008f88d9ee145c807812555977242cf5b0cf79d46427da29f6

  • SHA512

    52083db0c2ddd9b3a4859acf2f45602fa2ed98003e379348cd07ecba89ddd26735a5febbc0de41f375c80d7918da89e21ec2c5b94e6f047afdb3207091f7558e

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/Zc9ggeS6X0zh/:E5aIwC+Agr6S/FFC+Hh/

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe

    • Size

      1.1MB

    • MD5

      79def490bc257c50acbd8d39ba3c3dd0

    • SHA1

      0eecd42d71af1b81d8492586aee7d45cf668adef

    • SHA256

      4a78768ec0773d008f88d9ee145c807812555977242cf5b0cf79d46427da29f6

    • SHA512

      52083db0c2ddd9b3a4859acf2f45602fa2ed98003e379348cd07ecba89ddd26735a5febbc0de41f375c80d7918da89e21ec2c5b94e6f047afdb3207091f7558e

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/Zc9ggeS6X0zh/:E5aIwC+Agr6S/FFC+Hh/

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks