kpot | 75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056

Analysis

max time kernel
137s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe
Size

991KB
MD5

46c6fcd29dd1a1561bea9e8e5598f6d5
SHA1

33ff7809d4d3bca6ff4d795720397c29a79ae4de
SHA256

75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056
SHA512

215cd0c10ad2e7131c893fe7c1c81a6a22ba6ca0c54d4fb3502cbf95c05e8113b74c634c7efd6deb44382c1a1a93df7c48c110f9dbdc00ba0c8861fe0ce12b67
SSDEEP

24576:zQ5aILMCfmAUjzX6xQGCZLFdGm13J/NuV5:E5aIwC+Agr6S/FpJo5

Score

10^/10

kpot trickbot banker discovery stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002360b-21.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4568-15-0x00000000022F0000-0x0000000002319000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
Token: SeTcbPrivilege	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4568	75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe
2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2436	4568	75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe	92
PID 4568 wrote to memory of 2436	4568	75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe	92
PID 4568 wrote to memory of 2436	4568	75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe	92
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2436 wrote to memory of 1288	2436	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	93
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2608 wrote to memory of 2316	2608	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	107
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109
PID 2620 wrote to memory of 3984	2620	86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe
"C:\Users\Admin\AppData\Local\Temp\75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
1⤵
PID:4320

C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2316

C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\86963f9069828aaedf191bf9a2e7a12912092799eba77827776991cdad90c067.exe

Filesize
991KB

MD5
46c6fcd29dd1a1561bea9e8e5598f6d5

SHA1
33ff7809d4d3bca6ff4d795720397c29a79ae4de

SHA256
75853f9059727aaedf181bf8a2e6a12812082689eba66726665991cdad90c056

SHA512
215cd0c10ad2e7131c893fe7c1c81a6a22ba6ca0c54d4fb3502cbf95c05e8113b74c634c7efd6deb44382c1a1a93df7c48c110f9dbdc00ba0c8861fe0ce12b67

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
36KB

MD5
4667e86127672a75b318704b99313164

SHA1
ccb08ec3260b27622c722389615cfa5a64ef7067

SHA256
4458bdc681b325c46b643acab720bf8c6e501e6af6feab68ba8bd7ea9c91f443

SHA512
7753cc3371d8ca3bc35c8bf8e6479fce300b0873ce52234f23f5d4ed17c0c3fea8d345e62a3ae11fa2edffc49003707141696cd07e58617fb9a44a48d9c05395

Download Submit
memory/1288-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1288-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1288-51-0x0000022BFBDB0000-0x0000022BFBDB1000-memory.dmp

Filesize
4KB

Download
memory/2436-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2436-30-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2436-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2436-26-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-32-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-27-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-28-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-29-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-52-0x0000000003060000-0x000000000311E000-memory.dmp

Filesize
760KB

Download
memory/2436-31-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-53-0x0000000003160000-0x0000000003429000-memory.dmp

Filesize
2.8MB

Download
memory/2436-37-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-36-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-35-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-34-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2436-33-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2608-71-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2608-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-58-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-61-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-62-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-63-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-70-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/2608-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2608-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4568-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4568-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4568-15-0x00000000022F0000-0x0000000002319000-memory.dmp

Filesize
164KB

Download
memory/4568-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4568-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download