kpot | 33f0a60e2f8ac476e0b1b0a6c10ea2a81439d8d48096555c0ef1c0e4f0ca61d4

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe
Size

1.1MB
MD5

2ac2d0bbc159705bf28de4df295a7910
SHA1

846f379bcdbe87feeaeab142a0ff165de8712a2c
SHA256

33f0a60e2f8ac476e0b1b0a6c10ea2a81439d8d48096555c0ef1c0e4f0ca61d4
SHA512

2bc84bb47523e5b84547fa6ae47565f46cd3eee3abcc0176239061ddd04856c078e633c7d74971066b5b7ce97db7e36b62590af8c23937d0b942a4bff3426eb2
SSDEEP

24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU95QyILOt:E5aIwC+Agr6SNasOqW

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023279-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4076-15-0x0000000002320000-0x0000000002349000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
Token: SeTcbPrivilege	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4076	2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe
1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1404	4076	2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe	91
PID 4076 wrote to memory of 1404	4076	2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe	91
PID 4076 wrote to memory of 1404	4076	2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe	91
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 1404 wrote to memory of 2592	1404	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	92
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 2856 wrote to memory of 4508	2856	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	103
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105
PID 1172 wrote to memory of 764	1172	2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2ac2d0bbc159705bf28de4df295a7910_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3144

C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4508

C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\2ac2d0bbc169806bf29de4df296a8910_NeikiAnalytict.exe

Filesize
1.1MB

MD5
2ac2d0bbc159705bf28de4df295a7910

SHA1
846f379bcdbe87feeaeab142a0ff165de8712a2c

SHA256
33f0a60e2f8ac476e0b1b0a6c10ea2a81439d8d48096555c0ef1c0e4f0ca61d4

SHA512
2bc84bb47523e5b84547fa6ae47565f46cd3eee3abcc0176239061ddd04856c078e633c7d74971066b5b7ce97db7e36b62590af8c23937d0b942a4bff3426eb2

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
18KB

MD5
434f05dd3cbb9c55bda65a42bdeeeb56

SHA1
14e060360959269acf1c664ad32f7ac4aa769713

SHA256
12d65b4140065448e85639d4314530dd98c0253ae4626065781eb25fb4645ca2

SHA512
47dbbe83146925b79398b7745bd92a38172385304f0296c0fb08750df96fd7327a96e55569aac6d1e7853195f7d15d903fffddba980173957b1c39765f37ca77

Download Submit
memory/1404-53-0x0000000003170000-0x0000000003439000-memory.dmp

Filesize
2.8MB

Download
memory/1404-52-0x0000000002AA0000-0x0000000002B5E000-memory.dmp

Filesize
760KB

Download
memory/1404-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1404-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1404-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2592-51-0x000001FE40970000-0x000001FE40971000-memory.dmp

Filesize
4KB

Download
memory/2592-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2856-68-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-64-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-58-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-59-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-60-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-61-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-62-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-63-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-65-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-66-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-67-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-69-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2856-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2856-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4076-8-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-10-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-13-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-12-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-5-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-11-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-14-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-7-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-4-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-9-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4076-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4076-15-0x0000000002320000-0x0000000002349000-memory.dmp

Filesize
164KB

Download
memory/4076-2-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-6-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4076-3-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download