tinba | 2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573

General

Target

2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
Size

98KB
MD5

c266bc48d516ba152dac867159118ac0
SHA1

76d3f461a28daadc027e95b8fe472df6a597452f
SHA256

2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573
SHA512

05e221c738ab83f3c09242080a9008f70a1a18fb9ea02595805478a76d2609d6773353cfdad3b68100038435d4aac994f7bf45325284d5f97c837fb531fc9d57

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\666C9E14 = "C:\\Users\\Admin\\AppData\\Roaming\\666C9E14\\bin.exe"	winver.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe

description	pid	process	target process
PID 856 set thread context of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 3764 WerFault.exe DllHost.exe

pid	pid_target	process	target process
940	3764	WerFault.exe	DllHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exewinver.exeWerFault.exe

pid	process
856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
940	WerFault.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3044 Explorer.EXE

pid	process
3044	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

WerFault.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	940	WerFault.exe
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

1632 winver.exe

pid	process
1632	winver.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe

pid	process
856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exewinver.exe

description	pid	process	target process
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 856 wrote to memory of 3024	856	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
PID 3024 wrote to memory of 1632	3024	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	winver.exe
PID 3024 wrote to memory of 1632	3024	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	winver.exe
PID 3024 wrote to memory of 1632	3024	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	winver.exe
PID 3024 wrote to memory of 1632	3024	2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe	winver.exe
PID 1632 wrote to memory of 3044	1632	winver.exe	Explorer.EXE
PID 1632 wrote to memory of 2348	1632	winver.exe	sihost.exe
PID 1632 wrote to memory of 2356	1632	winver.exe	svchost.exe
PID 1632 wrote to memory of 2500	1632	winver.exe	taskhostw.exe
PID 1632 wrote to memory of 3044	1632	winver.exe	Explorer.EXE
PID 1632 wrote to memory of 3252	1632	winver.exe	ShellExperienceHost.exe
PID 1632 wrote to memory of 3264	1632	winver.exe	SearchUI.exe
PID 1632 wrote to memory of 3492	1632	winver.exe	RuntimeBroker.exe
PID 1632 wrote to memory of 3764	1632	winver.exe	DllHost.exe
PID 1632 wrote to memory of 4032	1632	winver.exe	DllHost.exe
PID 1632 wrote to memory of 188	1632	winver.exe
PID 1632 wrote to memory of 940	1632	winver.exe	WerFault.exe
PID 1632 wrote to memory of 3856	1632	winver.exe	slui.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2348

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Users\Admin\AppData\Local\Temp\2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
"C:\Users\Admin\AppData\Local\Temp\2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Temp\2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
C:\Users\Admin\AppData\Local\Temp\2df52c9713c926a3640558f3446334001f6a9b0747849cda74039c0674b39573.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\winver.exe
winver
4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3252

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3264

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3764 -s 836
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2500

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4032

C:\Windows\System32\slui.exe
C:\Windows\System32\slui.exe -Embedding
1⤵
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-114-0x0000000000A50000-0x0000000000A54000-memory.dmp

Filesize
16KB

Download
memory/940-130-0x00007FFAAED30000-0x00007FFAAED31000-memory.dmp

Filesize
4KB

Download
memory/940-129-0x00007FFAAED20000-0x00007FFAAED21000-memory.dmp

Filesize
4KB

Download
memory/940-128-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/1632-117-0x0000000000000000-mapping.dmp

Download
memory/1632-120-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2348-123-0x0000000000CC0000-0x0000000000CC6000-memory.dmp

Filesize
24KB

Download
memory/2356-124-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2500-125-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/3024-118-0x0000000000400000-0x0000000000404400-memory.dmp

Filesize
17KB

Download
memory/3024-119-0x00000000016C0000-0x000000000180A000-memory.dmp

Filesize
1.3MB

Download
memory/3024-116-0x0000000000401000-mapping.dmp

Download
memory/3024-115-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/3044-122-0x0000000001330000-0x0000000001336000-memory.dmp

Filesize
24KB

Download
memory/3044-121-0x0000000001320000-0x0000000001326000-memory.dmp

Filesize
24KB

Download
memory/3044-131-0x00007FFAAED40000-0x00007FFAAED41000-memory.dmp

Filesize
4KB

Download
memory/3492-126-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/3856-132-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download
memory/4032-127-0x0000000000DD0000-0x0000000000DD6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads