tinba | 11e8d690d96faf9092f3ce17ef36384660cab59bf2b1540f28c5671c26ecece2

Analysis

max time kernel
149s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
17-11-2020 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1f9e56f5f399655d7b00ed436c2514d.exe
Size

152KB
MD5

305ec15725b8982d7149c51c355e2040
SHA1

4855474dd9fe83c3c26d215fe5d44b855b2602f5
SHA256

11e8d690d96faf9092f3ce17ef36384660cab59bf2b1540f28c5671c26ecece2
SHA512

e919936a6b0d2603785060df589be2253a2d1ebdbb444e1c3e2b173957f31d0982dba6dc88215f2ce4772a916bb28fbfae51f94fdc09e746dc24fe850bd0f404

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\76A01B7A = "C:\\Users\\Admin\\AppData\\Roaming\\76A01B7A\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe
420	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
420	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1680	Explorer.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	76
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	76
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	76
PID 1028 wrote to memory of 420	1028	b1f9e56f5f399655d7b00ed436c2514d.exe	76
PID 420 wrote to memory of 1680	420	winver.exe	57
PID 420 wrote to memory of 2816	420	winver.exe	54
PID 420 wrote to memory of 2840	420	winver.exe	55
PID 420 wrote to memory of 2952	420	winver.exe	56
PID 420 wrote to memory of 1680	420	winver.exe	57
PID 420 wrote to memory of 3292	420	winver.exe	58
PID 420 wrote to memory of 3304	420	winver.exe	59
PID 420 wrote to memory of 3492	420	winver.exe	60
PID 420 wrote to memory of 3748	420	winver.exe	61
PID 420 wrote to memory of 2256	420	winver.exe	75

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2816

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2840

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2952

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:1680
- C:\Users\Admin\AppData\Local\Temp\b1f9e56f5f399655d7b00ed436c2514d.exe
  "C:\Users\Admin\AppData\Local\Temp\b1f9e56f5f399655d7b00ed436c2514d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:420

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3292

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-1-0x0000000001320000-0x0000000001327000-memory.dmp

Filesize
28KB

Download
memory/1680-5-0x0000000001110000-0x0000000001117000-memory.dmp

Filesize
28KB

Download
memory/2256-10-0x00000000008A0000-0x00000000008A7000-memory.dmp

Filesize
28KB

Download
memory/2816-2-0x0000000000FE0000-0x0000000000FE7000-memory.dmp

Filesize
28KB

Download
memory/2840-3-0x0000000000FC0000-0x0000000000FC7000-memory.dmp

Filesize
28KB

Download
memory/2952-4-0x00000000004E0000-0x00000000004E7000-memory.dmp

Filesize
28KB

Download
memory/3292-6-0x00000000002E0000-0x00000000002E7000-memory.dmp

Filesize
28KB

Download
memory/3304-7-0x0000000000C30000-0x0000000000C37000-memory.dmp

Filesize
28KB

Download
memory/3492-8-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/3748-9-0x0000000000EC0000-0x0000000000EC7000-memory.dmp

Filesize
28KB

Download