tinba | 7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb

Analysis

max time kernel
51s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe
Size 45KB
Sample221126-ntcfmsbf25
SHA256 7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb
MD5 205be4bfe8e7fa9812388b2cd80e535e
SHA1 e43d8b2751017c0fe815fa3bdcd90fb620389798
SHA512 a878ca368c8bb12b9a6e75ee00308d6d531b2020612f01c04fcf086b49457424ff63d1574a5031219d56cec969af0a34909f2fb8c809356156d9c4a64072a324
SSDEEP 768:oTYrljgxDrri6qewO2VuLnDm6thGYkH4JuxUul/w7S1Z0:ocjgdri7egVYDXT9i4o7/OS1u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6D4F117B = "C:\\Users\\Admin\\AppData\\Roaming\\6D4F117B\\bin.exe"	winver.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	winver.exe
1552	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1552	winver.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 4244 wrote to memory of 3608	4244	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	85
PID 3608 wrote to memory of 1552	3608	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	86
PID 3608 wrote to memory of 1552	3608	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	86
PID 3608 wrote to memory of 1552	3608	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	86
PID 3608 wrote to memory of 1552	3608	7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe	86
PID 1552 wrote to memory of 2716	1552	winver.exe	42
PID 1552 wrote to memory of 2392	1552	winver.exe	52
PID 1552 wrote to memory of 2412	1552	winver.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2716
- C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe
  "C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe
    "C:\Users\Admin\AppData\Local\Temp\7679db542a305b539835a449c0c45bb189a049319e31ff07d28597ebb0157ebb.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-136-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/3608-137-0x00000000012E0000-0x0000000001CE0000-memory.dmp

Download

memory/4244-132-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Download

memory/4244-133-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Download

memory/4244-135-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Download