Analysis
- max time kernel
154s - max time network
172s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/08/2021, 06:17
General
- Target dc0e8ab0cd66a18b2ccfbf0d2ab2ba018b8180272877898d4e9c5f3b0874c56a.exe
- Size 1024KB
- Sample210830-x1x4edff7s
- SHA256 dc0e8ab0cd66a18b2ccfbf0d2ab2ba018b8180272877898d4e9c5f3b0874c56a
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 2 IoCs
- Program crash 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3736 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\dc0e8ab0cd66a18b2ccfbf0d2ab2ba018b8180272877898d4e9c5f3b0874c56a.exe"C:\Users\Admin\AppData\Local\Temp\dc0e8ab0cd66a18b2ccfbf0d2ab2ba018b8180272877898d4e9c5f3b0874c56a.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1260-118-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1540-131-0x0000000000ED0000-0x0000000000ED6000-memory.dmp
memory/1852-128-0x00000000002B0000-0x00000000002B6000-memory.dmp
memory/2032-130-0x00007FFAB0E50000-0x00007FFAB0E51000-memory.dmp
memory/2032-129-0x0000000000070000-0x0000000000076000-memory.dmp
memory/2312-123-0x0000000000A30000-0x0000000000A36000-memory.dmp
memory/2332-125-0x0000000000580000-0x0000000000586000-memory.dmp
memory/2392-126-0x00000000002A0000-0x00000000002A6000-memory.dmp
memory/3016-122-0x00007FFAB0E40000-0x00007FFAB0E41000-memory.dmp
memory/3016-124-0x0000000000FB0000-0x0000000000FB6000-memory.dmp
memory/3016-121-0x00007FFAB0E50000-0x00007FFAB0E51000-memory.dmp
memory/3016-119-0x0000000000FF0000-0x0000000000FF6000-memory.dmp
memory/3016-120-0x00007FFAB0E60000-0x00007FFAB0E61000-memory.dmp
memory/3128-114-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3128-117-0x0000000002350000-0x0000000002D50000-memory.dmp
memory/3128-115-0x0000000000480000-0x00000000005CA000-memory.dmp
memory/3484-127-0x0000000000A00000-0x0000000000A06000-memory.dmp