tinba | 7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb

Analysis

max time kernel
224s
max time network
317s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe
Size 45KB
Sample221126-ntcfmsbf25
SHA256 7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb
MD5 205be4bfe8e7fa9812388b2cd80e535e
SHA1 e43d8b2751017c0fe815fa3bdcd90fb620389798
SHA512 a878ca368c8bb12b9a6e75ee00308d6d531b2020612f01c04fcf086b49457424ff63d1574a5031219d56cec969af0a34909f2fb8c809356156d9c4a64072a324
SSDEEP 768:oTYrljgxDrri6qewO2VuLnDm6thGYkH4JuxUul/w7S1Z0:ocjgdri7egVYDXT9i4o7/OS1u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\1F18C6C0 = "C:\\Users\\Admin\\AppData\\Roaming\\1F18C6C0\\bin.exe"	winver.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 576 set thread context of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe
1632	winver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1232	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1632	winver.exe
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 576 wrote to memory of 560	576	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	28
PID 560 wrote to memory of 1632	560	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	29
PID 560 wrote to memory of 1632	560	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	29
PID 560 wrote to memory of 1632	560	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	29
PID 560 wrote to memory of 1632	560	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	29
PID 560 wrote to memory of 1632	560	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	29
PID 1632 wrote to memory of 1232	1632	winver.exe	17
PID 1632 wrote to memory of 1128	1632	winver.exe	10
PID 1632 wrote to memory of 1180	1632	winver.exe	18
PID 1632 wrote to memory of 1232	1632	winver.exe	17
PID 1632 wrote to memory of 560	1632	winver.exe	28

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:1232
- C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe
  "C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe
    "C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1632

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-83-0x0000000077610000-0x0000000077790000-memory.dmp

Download

memory/560-55-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/560-56-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/560-60-0x0000000000410000-0x0000000000E10000-memory.dmp

Download

memory/560-78-0x0000000000030000-0x0000000000036000-memory.dmp

Download

memory/560-82-0x0000000000410000-0x0000000000E10000-memory.dmp

Download

memory/560-73-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/560-79-0x0000000077610000-0x0000000077790000-memory.dmp

Download

memory/576-59-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Download

memory/576-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Download

memory/1128-77-0x0000000000310000-0x0000000000316000-memory.dmp

Download

memory/1180-81-0x00000000000B0000-0x00000000000B6000-memory.dmp

Download

memory/1232-75-0x0000000002150000-0x0000000002156000-memory.dmp

Download

memory/1232-80-0x0000000002160000-0x0000000002166000-memory.dmp

Download

memory/1232-63-0x0000000002150000-0x0000000002156000-memory.dmp

Download

memory/1632-76-0x0000000077610000-0x0000000077790000-memory.dmp

Download

memory/1632-74-0x0000000000110000-0x0000000000116000-memory.dmp

Download

memory/1632-84-0x0000000000110000-0x0000000000116000-memory.dmp

Download

memory/1632-85-0x0000000077610000-0x0000000077790000-memory.dmp

Download