kpot | 9d5fe17a55ad755e319454fca91c842dd7d38ff5dd9c1cbf65c025d72b1d04a4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
Size

786KB
MD5

53dc2f64a5222c636c6c66f37c698bf0
SHA1

14176253508b886100b6c0025e43f386684de78c
SHA256

9d5fe17a55ad755e319454fca91c842dd7d38ff5dd9c1cbf65c025d72b1d04a4
SHA512

af8806977400bb9c4b431ebeaf186d459d4bd1a834902fb23aefddde4e844dd41352e5027ba298aa515acfce659aaf43081b62eaf52aff6f38bccda9abd7401c
SSDEEP

12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1u9f1OgU:zQ5aILMCfmAUjzX6xQGCZLFdGm1SfcgU

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023444-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4444-15-0x0000000003130000-0x0000000003159000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
Token: SeTcbPrivilege	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4444	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4048	4444	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	84
PID 4444 wrote to memory of 4048	4444	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	84
PID 4444 wrote to memory of 4048	4444	53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe	84
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 4048 wrote to memory of 1468	4048	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	85
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 864 wrote to memory of 4412	864	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	102
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112
PID 2352 wrote to memory of 3476	2352	63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\53dc2f64a5222c636c6c66f37c698bf0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1468

C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4412

C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\63dc2f74a6222c737c7c77f38c799bf0_NeikiAnalytict.exe

Filesize
786KB

MD5
53dc2f64a5222c636c6c66f37c698bf0

SHA1
14176253508b886100b6c0025e43f386684de78c

SHA256
9d5fe17a55ad755e319454fca91c842dd7d38ff5dd9c1cbf65c025d72b1d04a4

SHA512
af8806977400bb9c4b431ebeaf186d459d4bd1a834902fb23aefddde4e844dd41352e5027ba298aa515acfce659aaf43081b62eaf52aff6f38bccda9abd7401c

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
54KB

MD5
c804aa9d65d3f0bede1d4935af7aa64c

SHA1
1dcf663f4e31f1ee0014b469460f920a0388a8e7

SHA256
519d9c500308053f67db01ee3f30bceb4c3de27736a781bf0c204fc453554124

SHA512
f26e5d61e6bcd68233f841fcacf5af70552600b7fade6ba6dd39ff828a94da8b00b10ff0dd6cb69ad375c0153247f7296a993a734d6fd7dcd1a3dfffb9021839

Download Submit
memory/864-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/864-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/864-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/864-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/1468-51-0x000001DEBD880000-0x000001DEBD881000-memory.dmp

Filesize
4KB

Download
memory/1468-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1468-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4048-34-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-53-0x0000000003120000-0x00000000033E9000-memory.dmp

Filesize
2.8MB

Download
memory/4048-27-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-26-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-37-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-36-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-35-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-28-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-33-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4048-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4048-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4048-29-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-31-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-30-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-32-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4048-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/4444-9-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-10-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-3-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-4-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-5-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-6-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-2-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-7-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-15-0x0000000003130000-0x0000000003159000-memory.dmp

Filesize
164KB

Download
memory/4444-8-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-11-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-12-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-13-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4444-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4444-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4444-14-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download