kpot | d76d4465e13dcd53ae6fbe5c95303a0238d050cbe92bb4367c6fc68451210088

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe
Size

1.3MB
MD5

3784a3a2be550d859b28be0f9c7c7960
SHA1

f6f503654a065dbc035e363df148b09c3b3452d4
SHA256

d76d4465e13dcd53ae6fbe5c95303a0238d050cbe92bb4367c6fc68451210088
SHA512

0212b8e42461259ab59c7fef6c3935d10830ba40bd7c5a468f02201e94cbbeeeab6ed21a5c2288a2a5bcaf30ffc396d53fd7e70b5f3456b3c901303dfa6f5ceb
SSDEEP

24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1SdrzRjVYaQ/n2lbcMfcz5l8uF:E5aIwC+Agr6S/FYqOc2Z2

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023418-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/956-15-0x00000000029D0000-0x00000000029F9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
Token: SeTcbPrivilege	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
956	3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe
4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4892	956	3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe	82
PID 956 wrote to memory of 4892	956	3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe	82
PID 956 wrote to memory of 4892	956	3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe	82
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 4892 wrote to memory of 4848	4892	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	83
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1676 wrote to memory of 4664	1676	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	97
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99
PID 1576 wrote to memory of 4684	1576	3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3784a3a2be550d859b28be0f9c7c7960_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4848

C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4664

C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\3894a3a2be660d969b29be0f9c8c8970_NeikiAnalytict.exe

Filesize
1.3MB

MD5
3784a3a2be550d859b28be0f9c7c7960

SHA1
f6f503654a065dbc035e363df148b09c3b3452d4

SHA256
d76d4465e13dcd53ae6fbe5c95303a0238d050cbe92bb4367c6fc68451210088

SHA512
0212b8e42461259ab59c7fef6c3935d10830ba40bd7c5a468f02201e94cbbeeeab6ed21a5c2288a2a5bcaf30ffc396d53fd7e70b5f3456b3c901303dfa6f5ceb

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
61KB

MD5
0a62e84064de2cffbe802c17dcc99e25

SHA1
53fe4db50e3a2267a3d7ddfc53fe8745f66c31e9

SHA256
185d806b3a5eac3bd5c766a110daa97e65b5ffd74976852fda1fc5bd7af3496c

SHA512
5a2dc68f4b44f7bc3af42aaeb6252e263fb2c9f857977aeb8a9063c33d48b777d1f4f7382755dd3241801dc4c8c90dad51d739e3a53153ce9afa7f8861091e5a

Download Submit
memory/956-8-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-7-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-12-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-11-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-10-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-9-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-14-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-3-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-6-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-5-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-4-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-2-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/956-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/956-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/956-15-0x00000000029D0000-0x00000000029F9000-memory.dmp

Filesize
164KB

Download
memory/956-13-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/1676-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-66-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1676-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1676-69-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-68-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-67-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-58-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-65-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-64-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-63-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-60-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-61-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1676-62-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4848-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4848-51-0x0000020175070000-0x0000020175071000-memory.dmp

Filesize
4KB

Download
memory/4892-28-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-27-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-37-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/4892-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4892-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4892-26-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/4892-36-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-29-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-30-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-31-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-33-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-34-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-35-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4892-32-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download