Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    17-11-2020 15:20

General

  • Target

    aa02188daab3faaaba74081d7e9a4986.exe

  • Size

    184KB

  • MD5

    f59deb960309edee8ff6eee523f52006

  • SHA1

    933ab0fec556e4cd02d7971ec7fc0a3f1c000b8a

  • SHA256

    d7754476cbf09c62d377387cc0cea85bdad171cec82388f4ab2e2accf1d1f876

  • SHA512

    ff5ff71b5e47800429e77df9a491300bc282f4fec0133151e72611969257eb553e2c5441c7faec8b22a67d7c645ea5ca4c87f73c73b236cca8bf910cc6526f5d

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1128
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1228
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1268
        • C:\Users\Admin\AppData\Local\Temp\aa02188daab3faaaba74081d7e9a4986.exe
          "C:\Users\Admin\AppData\Local\Temp\aa02188daab3faaaba74081d7e9a4986.exe"
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1892
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1780

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1128-2-0x0000000000210000-0x0000000000216000-memory.dmp
        Filesize

        24KB

      • memory/1228-3-0x0000000001AD0000-0x0000000001AD6000-memory.dmp
        Filesize

        24KB

      • memory/1268-1-0x00000000025A0000-0x00000000025A6000-memory.dmp
        Filesize

        24KB

      • memory/1268-4-0x00000000025B0000-0x00000000025B6000-memory.dmp
        Filesize

        24KB

      • memory/1780-0-0x0000000000000000-mapping.dmp