tinba | 11e8d690d96faf9092f3ce17ef36384660cab59bf2b1540f28c5671c26ecece2

General

Target

b1f9e56f5f399655d7b00ed436c2514d.exe
Size

152KB
MD5

305ec15725b8982d7149c51c355e2040
SHA1

4855474dd9fe83c3c26d215fe5d44b855b2602f5
SHA256

11e8d690d96faf9092f3ce17ef36384660cab59bf2b1540f28c5671c26ecece2
SHA512

e919936a6b0d2603785060df589be2253a2d1ebdbb444e1c3e2b173957f31d0982dba6dc88215f2ce4772a916bb28fbfae51f94fdc09e746dc24fe850bd0f404

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\D02424DC = "C:\\Users\\Admin\\AppData\\Roaming\\D02424DC\\bin.exe"	winver.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe
2036	winver.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

winver.exeExplorer.EXE

pid process

2036 winver.exe
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

b1f9e56f5f399655d7b00ed436c2514d.exe

pid process

1080 b1f9e56f5f399655d7b00ed436c2514d.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1080	b1f9e56f5f399655d7b00ed436c2514d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b1f9e56f5f399655d7b00ed436c2514d.exewinver.exe

description	pid	process	target process
PID 1080 wrote to memory of 2036	1080	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1080 wrote to memory of 2036	1080	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1080 wrote to memory of 2036	1080	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1080 wrote to memory of 2036	1080	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1080 wrote to memory of 2036	1080	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 2036 wrote to memory of 1236	2036	winver.exe	Explorer.EXE
PID 2036 wrote to memory of 1116	2036	winver.exe	taskhost.exe
PID 2036 wrote to memory of 1176	2036	winver.exe	Dwm.exe
PID 2036 wrote to memory of 1236	2036	winver.exe	Explorer.EXE

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1236
- C:\Users\Admin\AppData\Local\Temp\b1f9e56f5f399655d7b00ed436c2514d.exe
  "C:\Users\Admin\AppData\Local\Temp\b1f9e56f5f399655d7b00ed436c2514d.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-0-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1116-3-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/1176-4-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/1236-2-0x0000000002B20000-0x0000000002B27000-memory.dmp

Filesize
28KB

Download
memory/1236-5-0x0000000002B30000-0x0000000002B37000-memory.dmp

Filesize
28KB

Download
memory/2036-1-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads