Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    11-05-2021 09:42

General

  • Target

    1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe

  • Size

    98KB

  • MD5

    ea01dcd803b0b6de2878f1486d532f6e

  • SHA1

    581e56a7e8a44441a52707445929513a2f994591

  • SHA256

    1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

  • SHA512

    59631ee3a3c95964619dcce1f2110979045e363630f639ac96fd47fa3f24b0965c3ed224682bfea8ea43bb0566c3eef0eb330f06c80027ff8e96ba25a9597d53

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
      "C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
        C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Windows\SysWOW64\winver.exe
          winver
          4⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1956
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1176
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1116

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1116-72-0x0000000001B40000-0x0000000001B46000-memory.dmp

        Filesize

        24KB

      • memory/1168-67-0x00000000017F0000-0x00000000021F0000-memory.dmp

        Filesize

        10.0MB

      • memory/1168-63-0x0000000000401000-mapping.dmp

      • memory/1168-62-0x0000000000400000-0x000000000149A000-memory.dmp

        Filesize

        16.6MB

      • memory/1168-66-0x0000000000400000-0x0000000000404400-memory.dmp

        Filesize

        17KB

      • memory/1176-73-0x00000000019C0000-0x00000000019C6000-memory.dmp

        Filesize

        24KB

      • memory/1208-74-0x0000000003EB0000-0x0000000003EB6000-memory.dmp

        Filesize

        24KB

      • memory/1208-71-0x0000000003EA0000-0x0000000003EA6000-memory.dmp

        Filesize

        24KB

      • memory/1208-77-0x0000000077810000-0x0000000077811000-memory.dmp

        Filesize

        4KB

      • memory/1208-75-0x0000000077840000-0x0000000077841000-memory.dmp

        Filesize

        4KB

      • memory/1208-76-0x0000000077830000-0x0000000077831000-memory.dmp

        Filesize

        4KB

      • memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmp

        Filesize

        8KB

      • memory/1820-61-0x00000000002E0000-0x00000000002E4000-memory.dmp

        Filesize

        16KB

      • memory/1956-64-0x0000000000000000-mapping.dmp

      • memory/1956-68-0x0000000000370000-0x0000000000386000-memory.dmp

        Filesize

        88KB

      • memory/1956-69-0x0000000000090000-0x0000000000096000-memory.dmp

        Filesize

        24KB

      • memory/1956-70-0x00000000000D0000-0x00000000000D1000-memory.dmp

        Filesize

        4KB