kpot | 9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe
Size

1.2MB
MD5

f33db5b227581a52c1d2486a708b1f13
SHA1

51baec939766f672246c1e17d7b246275753210d
SHA256

9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e
SHA512

826c14248e7a547cb82ce501921178d155f88ab4bb5f2faac459a28ac05f2bc0a5bae30bd3ced11ff4a0f0fdc838c6ea9e26f034d0aed33619c9e93806ec128d
SSDEEP

24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOVMId03vDM5CZe0PZ7:E5aIwC+Agr6StVEnmcK9dFCfl

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002347d-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1304-15-0x0000000003110000-0x0000000003139000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
Token: SeTcbPrivilege	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1304	9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe
2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2720	1304	9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe	83
PID 1304 wrote to memory of 2720	1304	9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe	83
PID 1304 wrote to memory of 2720	1304	9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe	83
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 2720 wrote to memory of 1876	2720	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	85
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3132 wrote to memory of 1008	3132	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	91
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94
PID 3928 wrote to memory of 4416	3928	9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe
"C:\Users\Admin\AppData\Local\Temp\9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1876

C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1008

C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\9080f2b29909b9e9e9c9c19962480b2340e4b7a6f20420dd6d1d0089928d2d7e.exe

Filesize
1.2MB

MD5
f33db5b227581a52c1d2486a708b1f13

SHA1
51baec939766f672246c1e17d7b246275753210d

SHA256
9070f2b29809b9e8e9c8c18852470b2340e4b6a5f20420dd5d1d0079927d2d6e

SHA512
826c14248e7a547cb82ce501921178d155f88ab4bb5f2faac459a28ac05f2bc0a5bae30bd3ced11ff4a0f0fdc838c6ea9e26f034d0aed33619c9e93806ec128d

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
46KB

MD5
14735923a43fb7daff1f089da079fd31

SHA1
a93ea05c5e37664eb8a44e7c42c1c37cb37f0323

SHA256
072caff1350e834cb0fb0f56c145b60ef4b5862c615459b71528aa48993f9fff

SHA512
09c38a40feb3a8aa131594675431c60efcac5124d20e9ae6c46f7c6c04ed7ee6ba4415dc7d597d82c3c7a558e35207ddc832349cb19735defebd040299c65f7f

Download Submit
memory/1304-2-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-14-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-13-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-12-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-8-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-11-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-10-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-9-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-7-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-6-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-5-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-4-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-3-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1304-15-0x0000000003110000-0x0000000003139000-memory.dmp

Filesize
164KB

Download
memory/1304-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1304-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1876-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1876-52-0x000001D3EA890000-0x000001D3EA891000-memory.dmp

Filesize
4KB

Download
memory/2720-37-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-36-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2720-35-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-34-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-33-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-32-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-31-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2720-30-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-29-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-28-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-27-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-26-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2720-51-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/2720-53-0x0000000003160000-0x0000000003429000-memory.dmp

Filesize
2.8MB

Download
memory/3132-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3132-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3132-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3132-84-0x0000000001C00000-0x0000000001CBE000-memory.dmp

Filesize
760KB

Download