kpot | 002f95bc9c8f1fe60cdad769e19a79acd77676abc83819e7efbbdfb76844322d

Analysis

max time kernel
138s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe
Size

1008KB
MD5

436ec7db1b32c8ebb61ab05f988c3400
SHA1

f3bff92c1a462adbfa49a6cc30bb09359b022b89
SHA256

002f95bc9c8f1fe60cdad769e19a79acd77676abc83819e7efbbdfb76844322d
SHA512

1b8e9d2da43285c2e7bb89c5713f5302e52a9b264877af1a74943a5f38d8e313c13edcb7eab6d68d04b139ec47aac8e5431c9a80a3ceb5407758db3b558755af
SSDEEP

12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVfDN:zQ5aILMCfmAUjzX6T0TlOnvPyQCfx

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023407-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3588-15-0x0000000002280000-0x00000000022A9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
Token: SeTcbPrivilege	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3588	436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe
4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4812	3588	436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe	83
PID 3588 wrote to memory of 4812	3588	436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe	83
PID 3588 wrote to memory of 4812	3588	436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe	83
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 4812 wrote to memory of 2384	4812	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	85
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2952 wrote to memory of 6080	2952	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	107
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118
PID 2820 wrote to memory of 1404	2820	437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\436ec7db1b32c8ebb61ab05f988c3400_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2384

C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:6080

C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\437ec8db1b32c9ebb71ab06f999c3400_NeikiAnalytict.exe

Filesize
1008KB

MD5
436ec7db1b32c8ebb61ab05f988c3400

SHA1
f3bff92c1a462adbfa49a6cc30bb09359b022b89

SHA256
002f95bc9c8f1fe60cdad769e19a79acd77676abc83819e7efbbdfb76844322d

SHA512
1b8e9d2da43285c2e7bb89c5713f5302e52a9b264877af1a74943a5f38d8e313c13edcb7eab6d68d04b139ec47aac8e5431c9a80a3ceb5407758db3b558755af

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
12KB

MD5
c83cdab694f0284acd7a3b0e3ddd4bbb

SHA1
962c67e5e64b855aab3436bf34530d4ca08354e3

SHA256
6dcd2754dc0a9275b5c775d26fe8d0db36496b1f70b5781c2a71b05e3e256ae8

SHA512
2119862cf55c32750a5577ced27faf05a6f5528bc51de1b52f410fbed18d8fb748e327620048c40eedfa9729eb45e25f8be7e9ca6300ec0dbe3f6f8bcce03dbf

Download Submit
memory/2384-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2384-51-0x000001D4A93A0000-0x000001D4A93A1000-memory.dmp

Filesize
4KB

Download
memory/2384-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2952-63-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-62-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-61-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-58-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2952-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2952-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3588-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3588-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3588-15-0x0000000002280000-0x00000000022A9000-memory.dmp

Filesize
164KB

Download
memory/3588-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3588-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4812-27-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-35-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-37-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/4812-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/4812-36-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4812-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4812-26-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4812-28-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-29-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-30-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-31-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-32-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-33-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4812-34-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download