kpot | 95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe
Size

1.3MB
MD5

5d81ee195a334c903eba273c2cc77f65
SHA1

139bd5905ac393dbf27b997e6a74ac34125b20e3
SHA256

95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb
SHA512

f068ad36a61757909f1aee007a0aad469d88b3dc279beb2340553d207ebc2ac5e8b3393b64fd835a4ed6292a4bd8c582345946f462d7c959acff207f8d9096c7
SSDEEP

24576:zQ5aILMCfmAUjzX6xQtjmssdqex1hl+dZNNzRS:E5aIwC+Agr6StYCNK

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023422-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1056-15-0x00000000021F0000-0x0000000002219000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
Token: SeTcbPrivilege	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1056	95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe
2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2008	1056	95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe	81
PID 1056 wrote to memory of 2008	1056	95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe	81
PID 1056 wrote to memory of 2008	1056	95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe	81
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 2008 wrote to memory of 2336	2008	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	82
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 1580 wrote to memory of 3020	1580	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	93
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95
PID 3428 wrote to memory of 4404	3428	96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe
"C:\Users\Admin\AppData\Local\Temp\95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2336

C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3020

C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\96b276db9e8739da8cd2069caf8bd7ea939c44b37fdc9931f3b3c016ca3609bb.exe

Filesize
1.3MB

MD5
5d81ee195a334c903eba273c2cc77f65

SHA1
139bd5905ac393dbf27b997e6a74ac34125b20e3

SHA256
95b265db8e7638da7cd2059caf7bd6ea939c44b36fdc9831f3b3c015ca3508bb

SHA512
f068ad36a61757909f1aee007a0aad469d88b3dc279beb2340553d207ebc2ac5e8b3393b64fd835a4ed6292a4bd8c582345946f462d7c959acff207f8d9096c7

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
32KB

MD5
dbf95e1696da3081fd1a042c8a02e278

SHA1
87bfa58b07ee151f4bc9056ce740ba03ac3d650a

SHA256
c8e69de104439eb8c32852f0bf7eef34e0e80898a61f88ebd4d3c6460334b589

SHA512
6c9cc4bf7c9208fa3b0211ae9fd7ea9c3290f73bfb614a7360668db88a7cb0ab778833be64dffb7c863cee92083768f05ede3f8555453375e5a27e00e405d14a

Download Submit
memory/1056-10-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-9-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1056-13-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-12-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-11-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-5-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1056-8-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-7-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-6-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-4-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-3-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-2-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1056-15-0x00000000021F0000-0x0000000002219000-memory.dmp

Filesize
164KB

Download
memory/1056-14-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1580-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-71-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1580-70-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1580-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1580-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2008-32-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-31-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/2008-53-0x0000000003160000-0x0000000003429000-memory.dmp

Filesize
2.8MB

Download
memory/2008-27-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2008-28-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-29-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-30-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-26-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-36-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-33-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-34-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-35-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-37-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2008-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2008-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2336-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2336-51-0x0000018672140000-0x0000018672141000-memory.dmp

Filesize
4KB

Download