tinba | 4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b

Analysis

max time kernel
155s
max time network
159s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe
Size 1024KB
Sample210830-9e4qe57732
SHA256 4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b
MD5 55f3e4b933a93021695a84f137ee6ca9
SHA1 6f820d4eee00bc652a6f40208f6024c79af12d2f
SHA512 9bf8a4f222f5694f7e5653bf0ea8fb9a1aff5b23ae51025d3f049105ea1a39036cbcde8c245cf6693625d72acd9aaa539fe0c981e7762d7448b99a1148ddb391
MD5 SHA1 SHA512

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\8CAA568C = "C:\\Users\\Admin\\AppData\\Roaming\\8CAA568C\\bin.exe"	winver.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	3756	WerFault.exe	11

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe
3012	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	WerFault.exe
Token: SeShutdownPrivilege	3052	Explorer.EXE
Token: SeCreatePagefilePrivilege	3052	Explorer.EXE
Token: SeShutdownPrivilege	3052	Explorer.EXE
Token: SeCreatePagefilePrivilege	3052	Explorer.EXE
Token: SeShutdownPrivilege	3052	Explorer.EXE
Token: SeCreatePagefilePrivilege	3052	Explorer.EXE
Token: SeShutdownPrivilege	3052	Explorer.EXE
Token: SeCreatePagefilePrivilege	3052	Explorer.EXE
Token: SeShutdownPrivilege	3052	Explorer.EXE
Token: SeCreatePagefilePrivilege	3052	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3052	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3012	808	4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe	76
PID 808 wrote to memory of 3012	808	4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe	76
PID 808 wrote to memory of 3012	808	4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe	76
PID 808 wrote to memory of 3012	808	4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe	76
PID 3012 wrote to memory of 3052	3012	winver.exe	4
PID 3012 wrote to memory of 2356	3012	winver.exe	25
PID 3012 wrote to memory of 2376	3012	winver.exe	24
PID 3012 wrote to memory of 2468	3012	winver.exe	23
PID 3012 wrote to memory of 3052	3012	winver.exe	4
PID 3012 wrote to memory of 3272	3012	winver.exe	13
PID 3012 wrote to memory of 3296	3012	winver.exe	12
PID 3012 wrote to memory of 3524	3012	winver.exe	5
PID 3012 wrote to memory of 3756	3012	winver.exe	11
PID 3012 wrote to memory of 188	3012	winver.exe
PID 3012 wrote to memory of 1856	3012	winver.exe	78
PID 3012 wrote to memory of 2200	3012	winver.exe	81

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3052
- C:\Users\Admin\AppData\Local\Temp\4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe
  "C:\Users\Admin\AppData\Local\Temp\4dddf1631105820554f95cbd2f7f3c481fa7d8ec18152188aad241cf4e74572b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3756 -s 848
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3296

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3272

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2376

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2356

C:\Windows\System32\slui.exe
C:\Windows\System32\slui.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-117-0x0000000002330000-0x0000000002D30000-memory.dmp

Download

memory/808-116-0x0000000000420000-0x00000000004CE000-memory.dmp

Download

memory/808-114-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1856-127-0x00007FF92BBA0000-0x00007FF92BBA1000-memory.dmp

Download

memory/1856-125-0x00000000000B0000-0x00000000000B6000-memory.dmp

Download

memory/1856-126-0x00007FF92BBB0000-0x00007FF92BBB1000-memory.dmp

Download

memory/2200-129-0x00000000007C0000-0x00000000007C6000-memory.dmp

Download

memory/2356-121-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Download

memory/2376-122-0x0000000000120000-0x0000000000126000-memory.dmp

Download

memory/2468-123-0x00000000006F0000-0x00000000006F6000-memory.dmp

Download

memory/3012-118-0x0000000000B50000-0x0000000000B56000-memory.dmp

Download

memory/3052-120-0x0000000000610000-0x0000000000616000-memory.dmp

Download

memory/3052-119-0x0000000002680000-0x0000000002686000-memory.dmp

Download

memory/3052-128-0x00007FF92BBC0000-0x00007FF92BBC1000-memory.dmp

Download

memory/3524-124-0x0000000000F10000-0x0000000000F16000-memory.dmp

Download