Analysis

  • max time kernel
    8s
  • max time network
    12s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2023 08:55

General

  • Target

    NEAS.78c6e04d35cf296d569133f4ab0369b0.exe

  • Size

    113KB

  • MD5

    78c6e04d35cf296d569133f4ab0369b0

  • SHA1

    dc41526fbf3e3c67d41e1a8f1a4df6dee571b5a4

  • SHA256

    806bfe2269333045a12a58d4a142c7e5faf414a1c44485993276c0877c957c1e

  • SHA512

    1c47b5f9a26184e39563168d2cf592bb120c384731b9a7954202f0bf921ee9c5382ed6ae70b11a028474fc9aec41216eb8906d21ebf4ea621994a3f3d2c70cd1

  • SSDEEP

    1536:giLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0E:giyvRmDLs/ZrwWjjAqGcfzWH

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3252
      • C:\Users\Admin\AppData\Local\Temp\NEAS.78c6e04d35cf296d569133f4ab0369b0.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.78c6e04d35cf296d569133f4ab0369b0.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3848
    • C:\Windows\system32\taskhostw.exe
      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
      1⤵
        PID:2540
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
        1⤵
          PID:2440
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2432

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2432-14-0x00000000009B0000-0x00000000009B6000-memory.dmp

            Filesize

            24KB

          • memory/2440-13-0x00000000006B0000-0x00000000006B6000-memory.dmp

            Filesize

            24KB

          • memory/2440-17-0x00000000006B0000-0x00000000006B6000-memory.dmp

            Filesize

            24KB

          • memory/2540-21-0x00000000007F0000-0x00000000007F6000-memory.dmp

            Filesize

            24KB

          • memory/2540-15-0x00000000007F0000-0x00000000007F6000-memory.dmp

            Filesize

            24KB

          • memory/3252-16-0x00000000014E0000-0x00000000014E6000-memory.dmp

            Filesize

            24KB

          • memory/3252-3-0x0000000001500000-0x0000000001506000-memory.dmp

            Filesize

            24KB

          • memory/3252-5-0x0000000001500000-0x0000000001506000-memory.dmp

            Filesize

            24KB

          • memory/3252-7-0x00007FFC245ED000-0x00007FFC245EE000-memory.dmp

            Filesize

            4KB

          • memory/3252-19-0x00000000014E0000-0x00000000014E6000-memory.dmp

            Filesize

            24KB

          • memory/3436-18-0x0000000000DD0000-0x0000000000DD6000-memory.dmp

            Filesize

            24KB

          • memory/3848-4-0x0000000002A20000-0x0000000002A26000-memory.dmp

            Filesize

            24KB

          • memory/3848-11-0x0000000002A20000-0x0000000002A26000-memory.dmp

            Filesize

            24KB

          • memory/3848-6-0x0000000077A52000-0x0000000077A53000-memory.dmp

            Filesize

            4KB

          • memory/4972-9-0x00000000022A0000-0x0000000002CA0000-memory.dmp

            Filesize

            10.0MB

          • memory/4972-8-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/4972-0-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/4972-2-0x00000000022A0000-0x0000000002CA0000-memory.dmp

            Filesize

            10.0MB

          • memory/4972-1-0x0000000002160000-0x0000000002161000-memory.dmp

            Filesize

            4KB