tinba | 93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46

Analysis

max time kernel
156s
max time network
156s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe
Size 1024KB
Sample210830-e5jb5dq9zx
SHA256 93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46
MD5 1769296a270b874956cc6fd657d50fa8
SHA1 ac579cc8f39c90727410293db043d40e43b5bb09
SHA512 678217bf30d507d063374ba69acbfa93587db787ccda7692c071e60ca79a73b0ba6c7b1962050a53f6f55db4e6655683f42c083759172ae8de46c78a3fbbe418
MD5 SHA1 SHA512

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\31361B7D = "C:\\Users\\Admin\\AppData\\Roaming\\31361B7D\\bin.exe"	winver.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	3876	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1788	winver.exe
1788	winver.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
2476	WerFault.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe
1788	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	WerFault.exe
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1788	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3092	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1788	656	93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe	75
PID 656 wrote to memory of 1788	656	93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe	75
PID 656 wrote to memory of 1788	656	93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe	75
PID 656 wrote to memory of 1788	656	93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe	75
PID 1788 wrote to memory of 3092	1788	winver.exe	20
PID 1788 wrote to memory of 2880	1788	winver.exe	23
PID 1788 wrote to memory of 2896	1788	winver.exe	22
PID 1788 wrote to memory of 2972	1788	winver.exe	21
PID 1788 wrote to memory of 3092	1788	winver.exe	20
PID 1788 wrote to memory of 3348	1788	winver.exe	12
PID 1788 wrote to memory of 3360	1788	winver.exe	19
PID 1788 wrote to memory of 3604	1788	winver.exe	18
PID 1788 wrote to memory of 3876	1788	winver.exe	17
PID 1788 wrote to memory of 3908	1788	winver.exe
PID 1788 wrote to memory of 2476	1788	winver.exe	79
PID 1788 wrote to memory of 2204	1788	winver.exe	80

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3348

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3876 -s 852
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3604

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3360

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3092
- C:\Users\Admin\AppData\Local\Temp\93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe
  "C:\Users\Admin\AppData\Local\Temp\93510b901bbadce4f4e225e0bc0fa80d4354da35bbf2b76b8d55c7df826bca46.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1788

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2972

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2896

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2880

C:\Windows\System32\slui.exe
C:\Windows\System32\slui.exe -Embedding
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-115-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/656-116-0x00000000021D0000-0x0000000002BD0000-memory.dmp

Download

memory/656-114-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1788-118-0x00000000029D0000-0x00000000029D6000-memory.dmp

Download

memory/2204-128-0x0000000000960000-0x0000000000966000-memory.dmp

Download

memory/2476-127-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/2880-122-0x0000000000590000-0x0000000000596000-memory.dmp

Download

memory/2896-123-0x0000000000B70000-0x0000000000B76000-memory.dmp

Download

memory/2972-124-0x00000000009A0000-0x00000000009A6000-memory.dmp

Download

memory/3092-120-0x00007FFDDF9D0000-0x00007FFDDF9D1000-memory.dmp

Download

memory/3092-121-0x0000000000A40000-0x0000000000A46000-memory.dmp

Download

memory/3092-126-0x00007FFDDF9E0000-0x00007FFDDF9E1000-memory.dmp

Download

memory/3092-119-0x0000000000AC0000-0x0000000000AC6000-memory.dmp

Download

memory/3604-125-0x0000000000EC0000-0x0000000000EC6000-memory.dmp

Download