tinba | 82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2022, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe
Size 229KB
Sample221119-h2ryeaaa66
SHA256 82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4
MD5 3a623cc24b3d043bca5163e586c64e10
SHA1 145ca718a91a5ad790a5ba52286dabc02d06ffbf
SHA512 c74985956da8b86355022f663594bee13a5a48d01d6ae15566b1580edeffde5483dbe2d4bb53080f4189f193cb5a5ccbf24d5fe3650ed2a70e605fe905a101d6
SSDEEP 6144:uR9ehVYVGgCgPNXCCtKhOfKETyFqSYVmM7:uR4hVYVGHgPEHhOfKETyLYVm2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	winver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1C46D9B0 = "C:\\Users\\Admin\\AppData\\Roaming\\1C46D9B0\\bin.exe"	winver.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	3288	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe
5028	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
992	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	992	Explorer.EXE
Token: SeCreatePagefilePrivilege	992	Explorer.EXE
Token: SeShutdownPrivilege	3452	RuntimeBroker.exe
Token: SeShutdownPrivilege	3452	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5028	winver.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 5028	1944	82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe	83
PID 1944 wrote to memory of 5028	1944	82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe	83
PID 1944 wrote to memory of 5028	1944	82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe	83
PID 1944 wrote to memory of 5028	1944	82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe	83
PID 5028 wrote to memory of 992	5028	winver.exe	27
PID 5028 wrote to memory of 2304	5028	winver.exe	24
PID 5028 wrote to memory of 2316	5028	winver.exe	63
PID 5028 wrote to memory of 2428	5028	winver.exe	62
PID 5028 wrote to memory of 992	5028	winver.exe	27
PID 5028 wrote to memory of 3080	5028	winver.exe	29
PID 5028 wrote to memory of 3288	5028	winver.exe	28
PID 5028 wrote to memory of 3376	5028	winver.exe	30
PID 5028 wrote to memory of 3452	5028	winver.exe	33
PID 5028 wrote to memory of 3544	5028	winver.exe	35
PID 5028 wrote to memory of 3804	5028	winver.exe	36
PID 5028 wrote to memory of 4800	5028	winver.exe	39
PID 5028 wrote to memory of 4712	5028	winver.exe	53

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2304

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:992
- C:\Users\Admin\AppData\Local\Temp\82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe
  "C:\Users\Admin\AppData\Local\Temp\82ac2defe9db6216f02d0950b977de259037c7cfbdd6007adfb6cc49fbf3d3f4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3288 -s 972
  2⤵
  - Program crash
  PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4800

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:4712

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2316

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 3288 -ip 3288
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-137-0x0000000000680000-0x0000000000686000-memory.dmp

Download

memory/992-135-0x0000000000690000-0x0000000000696000-memory.dmp

Download

memory/1944-133-0x00000000025B0000-0x0000000002FB0000-memory.dmp

Download

memory/2304-136-0x0000000000070000-0x0000000000076000-memory.dmp

Download

memory/2316-138-0x0000000000800000-0x0000000000806000-memory.dmp

Download

memory/2428-139-0x0000000000490000-0x0000000000496000-memory.dmp

Download

memory/3080-140-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/3376-142-0x0000000000970000-0x0000000000976000-memory.dmp

Download

memory/3452-141-0x0000000000E00000-0x0000000000E06000-memory.dmp

Download

memory/3804-143-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

Download

memory/4800-144-0x0000000000D20000-0x0000000000D26000-memory.dmp

Download

memory/5028-134-0x0000000000740000-0x0000000000746000-memory.dmp

Download

memory/5028-145-0x0000000000740000-0x0000000000746000-memory.dmp

Download