kpot | a804afe454e9930a1fbe9884e7c1b0b8485f99e476e2ce2b6eabeba974ac9737

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe
Size

799KB
MD5

0e2068c57ded8125148705bd903eead0
SHA1

62cc25f2fef878e5b35b5f236614a3058556b635
SHA256

a804afe454e9930a1fbe9884e7c1b0b8485f99e476e2ce2b6eabeba974ac9737
SHA512

9f79c6b040816c9419daf0a384533b8640fd03f40418f20e011b19d68f846c32c91b26bce5e71336428c87c882df746e18013268a12b8b3dee16d16ec9b5635a
SSDEEP

12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1u9hf0KM:zQ5aILMCfmAUjzX6xQGCZLFdGm1ShhM

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/2012-15-0x0000000002390000-0x00000000023B9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

pid	process
1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

description	pid	process
Token: SeTcbPrivilege	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
Token: SeTcbPrivilege	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

pid	process
2012	0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe
1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 2012 wrote to memory of 1292	2012	0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
PID 2012 wrote to memory of 1292	2012	0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
PID 2012 wrote to memory of 1292	2012	0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 1292 wrote to memory of 5040	1292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 2292 wrote to memory of 428	2292	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe
PID 860 wrote to memory of 1064	860	0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e2068c57ded8125148705bd903eead0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:5040

C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:428

C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\0e2079c68ded9126149806bd903eead0_NeikiAnalytict.exe

Filesize
799KB

MD5
0e2068c57ded8125148705bd903eead0

SHA1
62cc25f2fef878e5b35b5f236614a3058556b635

SHA256
a804afe454e9930a1fbe9884e7c1b0b8485f99e476e2ce2b6eabeba974ac9737

SHA512
9f79c6b040816c9419daf0a384533b8640fd03f40418f20e011b19d68f846c32c91b26bce5e71336428c87c882df746e18013268a12b8b3dee16d16ec9b5635a

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
32KB

MD5
a8ba16e6ce89d9b34dc41a052de00622

SHA1
76f16c98924e5d91bffffb9f0fa4e4a3aa6e2cc3

SHA256
3c11c7306a2e49f5caae6a15ad2848e912a701cfd9408cc97f435710ba09ab98

SHA512
a13093a15ae55c78bd544d18853ec91a7eadca3d08195c0bdb2928ac44c06c8e771e644b4d0a1394f64eac9d905275d67f3d100333d4eb285421d4aad4b0506a

Download Submit
memory/1292-32-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-53-0x0000000003170000-0x0000000003439000-memory.dmp

Filesize
2.8MB

Download
memory/1292-28-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-29-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-30-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-31-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1292-27-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-52-0x00000000030B0000-0x000000000316E000-memory.dmp

Filesize
760KB

Download
memory/1292-34-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-35-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-36-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-37-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1292-26-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1292-33-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/2012-7-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-15-0x0000000002390000-0x00000000023B9000-memory.dmp

Filesize
164KB

Download
memory/2012-4-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-6-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-2-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-3-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-5-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-8-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2012-9-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-10-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-11-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-12-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-13-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-14-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2012-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2292-69-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-61-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2292-60-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-67-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-62-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-65-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-66-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-58-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-71-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2292-68-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-64-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-63-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2292-59-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/5040-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/5040-51-0x0000020E4AF00000-0x0000020E4AF01000-memory.dmp

Filesize
4KB

Download
memory/5040-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download