kpot | 9d5fe17a55ad755e319454fca91c842dd7d38ff5dd9c1cbf65c025d72b1d04a4

Analysis

max time kernel
135s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
Size

786KB
MD5

53dc2f64a5222c636c6c66f37c698bf0
SHA1

14176253508b886100b6c0025e43f386684de78c
SHA256

9d5fe17a55ad755e319454fca91c842dd7d38ff5dd9c1cbf65c025d72b1d04a4
SHA512

af8806977400bb9c4b431ebeaf186d459d4bd1a834902fb23aefddde4e844dd41352e5027ba298aa515acfce659aaf43081b62eaf52aff6f38bccda9abd7401c
SSDEEP

12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1u9f1OgU:zQ5aILMCfmAUjzX6xQGCZLFdGm1SfcgU

Score

10^/10

kpot trickbot banker evasion execution stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016575-26.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/2064-15-0x0000000000500000-0x0000000000529000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
1928	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
3008	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Loads dropped DLL 2 IoCs

pid	Process
2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2536	sc.exe
2664	sc.exe
2936	sc.exe
2332	sc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
2604	powershell.exe
2308	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeTcbPrivilege	1928	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
Token: SeTcbPrivilege	3008	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
1928	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
3008	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2248	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	28
PID 2064 wrote to memory of 2248	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	28
PID 2064 wrote to memory of 2248	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	28
PID 2064 wrote to memory of 2248	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	28
PID 2064 wrote to memory of 2360	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	29
PID 2064 wrote to memory of 2360	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	29
PID 2064 wrote to memory of 2360	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	29
PID 2064 wrote to memory of 2360	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	29
PID 2064 wrote to memory of 2976	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	32
PID 2064 wrote to memory of 2976	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	32
PID 2064 wrote to memory of 2976	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	32
PID 2064 wrote to memory of 2976	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	32
PID 2360 wrote to memory of 2536	2360	cmd.exe	34
PID 2360 wrote to memory of 2536	2360	cmd.exe	34
PID 2360 wrote to memory of 2536	2360	cmd.exe	34
PID 2360 wrote to memory of 2536	2360	cmd.exe	34
PID 2064 wrote to memory of 2660	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	35
PID 2064 wrote to memory of 2660	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	35
PID 2064 wrote to memory of 2660	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	35
PID 2064 wrote to memory of 2660	2064	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2664	2248	cmd.exe	36
PID 2248 wrote to memory of 2664	2248	cmd.exe	36
PID 2248 wrote to memory of 2664	2248	cmd.exe	36
PID 2248 wrote to memory of 2664	2248	cmd.exe	36
PID 2976 wrote to memory of 2308	2976	cmd.exe	37
PID 2976 wrote to memory of 2308	2976	cmd.exe	37
PID 2976 wrote to memory of 2308	2976	cmd.exe	37
PID 2976 wrote to memory of 2308	2976	cmd.exe	37
PID 2660 wrote to memory of 2756	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	38
PID 2660 wrote to memory of 2756	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	38
PID 2660 wrote to memory of 2756	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	38
PID 2660 wrote to memory of 2756	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	38
PID 2660 wrote to memory of 2776	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	39
PID 2660 wrote to memory of 2776	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	39
PID 2660 wrote to memory of 2776	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	39
PID 2660 wrote to memory of 2776	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	39
PID 2660 wrote to memory of 2456	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	40
PID 2660 wrote to memory of 2456	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	40
PID 2660 wrote to memory of 2456	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	40
PID 2660 wrote to memory of 2456	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	40
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42
PID 2660 wrote to memory of 2624	2660	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    /c sc stop WinDefend
    3⤵
    PID:2756
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    /c sc delete WinDefend
    3⤵
    PID:2776
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WinDefend
      4⤵
      Launches sc.exe
      PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:2456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2624

C:\Windows\system32\taskeng.exe
taskeng.exe {949B23CD-6330-4B27-AFE5-E4788C266DCB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:3000
- C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1928
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2292
- C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
815968f63f8df175f549c58f8be0d488

SHA1
4e9dfc00ba5fe28bd994c5980eb67819f45f88af

SHA256
8c7d0f3da8b073a990641e3343c255739aa88ba774b1599a4e4bf7245bc2784d

SHA512
82316a4d77c9dfb59740fbb7b55edefec3543b118721a76c922709e73beac47c1848937acee3d9ad1b2509ffec1506039f229b01162459c31dcb00e4dd91c6a7

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Filesize
786KB

MD5
53dc2f64a5222c636c6c66f37c698bf0

SHA1
14176253508b886100b6c0025e43f386684de78c

SHA256
9d5fe17a55ad755e319454fca91c842dd7d38ff5dd9c1cbf65c025d72b1d04a4

SHA512
af8806977400bb9c4b431ebeaf186d459d4bd1a834902fb23aefddde4e844dd41352e5027ba298aa515acfce659aaf43081b62eaf52aff6f38bccda9abd7401c

Download Submit
memory/1928-72-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-75-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-74-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-73-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-76-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-71-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-70-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-69-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-68-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-67-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-66-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1928-77-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2064-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2064-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2064-15-0x0000000000500000-0x0000000000529000-memory.dmp

Filesize
164KB

Download
memory/2064-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-12-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-10-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-9-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2064-7-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2624-49-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2624-50-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2660-39-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-44-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2660-30-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-31-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-32-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-33-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-34-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-35-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-36-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-37-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-38-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-40-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-41-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2660-45-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download