kpot | e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe
Size

1022KB
MD5

31a5ef3bf7dd643ee076c3deba1a2476
SHA1

cf4f98e36ec8a6401696e8bf8d4d1cd6677a792d
SHA256

e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f
SHA512

7854ea618f67448e8d0036698e3613dd1d135bb3252b0e3af56119207156c759df2e60b833d9f514bd04e190390b277ebb6e4dcdb9aca762af53ead50a08ba1a
SSDEEP

24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU97uh:E5aIwC+Agr6SNasZ

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002340b-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/2632-15-0x0000000002210000-0x0000000002239000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
Token: SeTcbPrivilege	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2632	e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe
4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4192	2632	e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe	84
PID 2632 wrote to memory of 4192	2632	e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe	84
PID 2632 wrote to memory of 4192	2632	e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe	84
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 4192 wrote to memory of 4600	4192	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	85
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 1140 wrote to memory of 660	1140	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	103
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112
PID 3452 wrote to memory of 5040	3452	e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe
"C:\Users\Admin\AppData\Local\Temp\e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4600

C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:660

C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\e0b12b669fac98b14c4e1299c81bcb49914b9046ffc69f18aa926d91c2fd319f.exe

Filesize
1022KB

MD5
31a5ef3bf7dd643ee076c3deba1a2476

SHA1
cf4f98e36ec8a6401696e8bf8d4d1cd6677a792d

SHA256
e0b12b559fac97b14c4e1298c71bcb48814b9045ffc58f17aa825d81c2fd318f

SHA512
7854ea618f67448e8d0036698e3613dd1d135bb3252b0e3af56119207156c759df2e60b833d9f514bd04e190390b277ebb6e4dcdb9aca762af53ead50a08ba1a

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
32KB

MD5
c1bdfd4ce5f187b53af07dca7a458e7d

SHA1
8b4ae47f1751c4fbc1e9c9eb2ba82a730d2932ea

SHA256
29123cab2d16b970c777fb4738d894dda1445ca17bd3f1f64de143dffce005be

SHA512
e7144e9fd02c4337aa05baef91c4d6ed60d7214114eedf92fe64ba32da9e1a67229666be25e10f88a813f2506cb6cad6af1193e640d00df40b70e65b2624b2fb

Download Submit
memory/1140-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1140-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1140-58-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-59-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-60-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-61-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-62-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-63-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-64-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-65-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-66-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-67-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-68-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1140-69-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2632-5-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-2-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-13-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-12-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-11-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-15-0x0000000002210000-0x0000000002239000-memory.dmp

Filesize
164KB

Download
memory/2632-10-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-9-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-8-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-7-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2632-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2632-6-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-14-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-4-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2632-3-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/4192-29-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-31-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4192-53-0x0000000003170000-0x0000000003439000-memory.dmp

Filesize
2.8MB

Download
memory/4192-52-0x00000000030B0000-0x000000000316E000-memory.dmp

Filesize
760KB

Download
memory/4192-36-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-35-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4192-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4192-27-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-28-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-37-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-30-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-26-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-32-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-33-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4192-34-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4600-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4600-51-0x000001DCF2640000-0x000001DCF2641000-memory.dmp

Filesize
4KB

Download