Overview

overview

10

Static

static

10

36da7ef1e6...cs.exe

windows7-x64

10

36da7ef1e6...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36da7ef1e692ecf7527ae95cae37a5e0_NeikiAnalytics.exe

  • Size

    1.2MB

  • Sample

    240528-hcj69she3s

  • MD5

    36da7ef1e692ecf7527ae95cae37a5e0

  • SHA1

    77dfb4c81238bd58e9ff5ea687709f445ac72aed

  • SHA256

    da03b27e9540dfd89924309007b942222b53aa693e36ffd55a239ff1c95b3fcc

  • SHA512

    04a0afbbf576c8d52ddb51c678bb7519fe5467f7e0c1b6bd93e3a7a7ffcdebc9fcd119bfd5feba069a75cbf6c13c37519836d2e9999f06323ee5d7e32d33b1bb

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wni7:E5aIwC+Agr6StVEnmcKxY/O1r7

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      36da7ef1e692ecf7527ae95cae37a5e0_NeikiAnalytics.exe

    • Size

      1.2MB

    • MD5

      36da7ef1e692ecf7527ae95cae37a5e0

    • SHA1

      77dfb4c81238bd58e9ff5ea687709f445ac72aed

    • SHA256

      da03b27e9540dfd89924309007b942222b53aa693e36ffd55a239ff1c95b3fcc

    • SHA512

      04a0afbbf576c8d52ddb51c678bb7519fe5467f7e0c1b6bd93e3a7a7ffcdebc9fcd119bfd5feba069a75cbf6c13c37519836d2e9999f06323ee5d7e32d33b1bb

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wni7:E5aIwC+Agr6StVEnmcKxY/O1r7

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks