Analysis
- max time kernel
158s - max time network
156s - platform
windows7_x64 - resource
win7v20210408 - submitted
30/08/2021, 06:14
General
- Target 4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe
- Size 1024KB
- Sample210830-9e4qe57732
- SHA256 4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe"C:\Users\Admin\AppData\Local\Temp\4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1096-71-0x0000000000150000-0x0000000000156000-memory.dmp
memory/1172-72-0x0000000001AC0000-0x0000000001AC6000-memory.dmp
memory/1200-67-0x0000000003A80000-0x0000000003A86000-memory.dmp
memory/1200-74-0x0000000077910000-0x0000000077911000-memory.dmp
memory/1200-73-0x0000000003A90000-0x0000000003A96000-memory.dmp
memory/1200-68-0x00000000778F0000-0x00000000778F1000-memory.dmp
memory/1200-69-0x0000000077900000-0x0000000077901000-memory.dmp
memory/1848-63-0x0000000000020000-0x0000000000021000-memory.dmp
memory/1848-64-0x0000000001E70000-0x0000000002870000-memory.dmp
memory/1848-60-0x0000000000400000-0x000000000041A000-memory.dmp
memory/1960-65-0x00000000000D0000-0x00000000000E6000-memory.dmp
memory/1960-66-0x0000000000160000-0x0000000000166000-memory.dmp
memory/1960-70-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1960-62-0x00000000757C1000-0x00000000757C3000-memory.dmp