Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
13/06/2023, 11:52
General
- Target 04228599.exe
- Size 191KB
- Sample230613-n1wsvsga49
- SHA256 25f771e57e57c0b078285aeda8b48e0a8ac77e02e4202193b2eae25d415f9e11
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\04228599.exe"C:\Users\Admin\AppData\Local\Temp\04228599.exe"2⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/788-62-0x00000000001C0000-0x00000000001C7000-memory.dmp
memory/788-87-0x00000000001C0000-0x00000000001C7000-memory.dmp
memory/788-80-0x0000000000210000-0x0000000000211000-memory.dmp
memory/788-64-0x00000000001C0000-0x00000000001C7000-memory.dmp
memory/788-60-0x00000000001C0000-0x00000000001C7000-memory.dmp
memory/788-65-0x0000000000200000-0x0000000000201000-memory.dmp
memory/1120-76-0x0000000001BC0000-0x0000000001BC7000-memory.dmp
memory/1184-71-0x0000000001B40000-0x0000000001B47000-memory.dmp
memory/1184-77-0x0000000001B40000-0x0000000001B47000-memory.dmp
memory/1212-82-0x0000000077250000-0x0000000077251000-memory.dmp
memory/1212-61-0x0000000003000000-0x0000000003007000-memory.dmp
memory/1212-89-0x000007FE86960000-0x000007FE8696A000-memory.dmp
memory/1212-88-0x0000000077240000-0x0000000077241000-memory.dmp
memory/1212-73-0x0000000003010000-0x0000000003017000-memory.dmp
memory/1212-78-0x0000000003010000-0x0000000003017000-memory.dmp
memory/1212-59-0x0000000003000000-0x0000000003007000-memory.dmp
memory/1212-58-0x0000000003000000-0x0000000003007000-memory.dmp
memory/1292-79-0x0000000000210000-0x0000000000217000-memory.dmp
memory/1292-75-0x0000000000210000-0x0000000000217000-memory.dmp
memory/1324-56-0x0000000000310000-0x0000000000311000-memory.dmp
memory/1324-63-0x0000000008730000-0x0000000009130000-memory.dmp
memory/1324-55-0x0000000000310000-0x0000000000311000-memory.dmp
memory/1324-54-0x0000000002020000-0x00000000021B0000-memory.dmp
memory/1324-67-0x0000000000400000-0x0000000000436000-memory.dmp