tinba | 11e8d690d96faf9092f3ce17ef36384660cab59bf2b1540f28c5671c26ecece2

General

Target

b1f9e56f5f399655d7b00ed436c2514d.exe
Size

152KB
MD5

305ec15725b8982d7149c51c355e2040
SHA1

4855474dd9fe83c3c26d215fe5d44b855b2602f5
SHA256

11e8d690d96faf9092f3ce17ef36384660cab59bf2b1540f28c5671c26ecece2
SHA512

e919936a6b0d2603785060df589be2253a2d1ebdbb444e1c3e2b173957f31d0982dba6dc88215f2ce4772a916bb28fbfae51f94fdc09e746dc24fe850bd0f404

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\76A01B7A = "C:\\Users\\Admin\\AppData\\Roaming\\76A01B7A\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

420 winver.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1680 Explorer.EXE

pid	process
1680	Explorer.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b1f9e56f5f399655d7b00ed436c2514d.exewinver.exe

description	pid	process	target process
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	winver.exe
PID 420 wrote to memory of 1680	420	winver.exe	Explorer.EXE
PID 420 wrote to memory of 2816	420	winver.exe	sihost.exe
PID 420 wrote to memory of 2840	420	winver.exe	svchost.exe
PID 420 wrote to memory of 2952	420	winver.exe	taskhostw.exe
PID 420 wrote to memory of 1680	420	winver.exe	Explorer.EXE
PID 420 wrote to memory of 3292	420	winver.exe	ShellExperienceHost.exe
PID 420 wrote to memory of 3304	420	winver.exe	SearchUI.exe
PID 420 wrote to memory of 3492	420	winver.exe	RuntimeBroker.exe
PID 420 wrote to memory of 3748	420	winver.exe	DllHost.exe
PID 420 wrote to memory of 2256	420	winver.exe	DllHost.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2816

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2840

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2952

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:1680

C:\Users\Admin\AppData\Local\Temp\b1f9e56f5f399655d7b00ed436c2514d.exe
"C:\Users\Admin\AppData\Local\Temp\b1f9e56f5f399655d7b00ed436c2514d.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:420

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3292

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-0-0x0000000000000000-mapping.dmp

Download
memory/1680-1-0x0000000001320000-0x0000000001327000-memory.dmp

Filesize
28KB

Download
memory/1680-5-0x0000000001110000-0x0000000001117000-memory.dmp

Filesize
28KB

Download
memory/2256-10-0x00000000008A0000-0x00000000008A7000-memory.dmp

Filesize
28KB

Download
memory/2816-2-0x0000000000FE0000-0x0000000000FE7000-memory.dmp

Filesize
28KB

Download
memory/2840-3-0x0000000000FC0000-0x0000000000FC7000-memory.dmp

Filesize
28KB

Download
memory/2952-4-0x00000000004E0000-0x00000000004E7000-memory.dmp

Filesize
28KB

Download
memory/3292-6-0x00000000002E0000-0x00000000002E7000-memory.dmp

Filesize
28KB

Download
memory/3304-7-0x0000000000C30000-0x0000000000C37000-memory.dmp

Filesize
28KB

Download
memory/3492-8-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/3748-9-0x0000000000EC0000-0x0000000000EC7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads