tinba | 7649864b9cfafa2f43fcdea5a0b8d6e87443fd5e561f76c554ce632295f58fc0

Analysis

max time kernel
7s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6d1fa6afe38d7a3a5bc5813f70e12ea.exe
Size 88KB
Sample231220-twydsadde7
SHA256 7649864b9cfafa2f43fcdea5a0b8d6e87443fd5e561f76c554ce632295f58fc0
MD5 e6d1fa6afe38d7a3a5bc5813f70e12ea
SHA1 5be9bad09d6a2da737c96d651bfa04c71d8fb096
SHA512 ef414d180c807920bcbb0cf8ac1aa4bff9ef5cd53de9485b70023b53a8023feb3e9f7dc010da072cd16153c40420827e43ab2ca5bce8990072b79e6c0d1aa06a
SSDEEP 1536:pPx+riFFG1g3K6KUm3wEeQqjh+rmKVsNsU:vYdsFE2jwqWsNsU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\256B4512 = "C:\\Users\\Admin\\AppData\\Roaming\\256B4512\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3940	winver.exe
3940	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3940	winver.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3940	3116	e6d1fa6afe38d7a3a5bc5813f70e12ea.exe	90
PID 3116 wrote to memory of 3940	3116	e6d1fa6afe38d7a3a5bc5813f70e12ea.exe	90
PID 3116 wrote to memory of 3940	3116	e6d1fa6afe38d7a3a5bc5813f70e12ea.exe	90
PID 3116 wrote to memory of 3940	3116	e6d1fa6afe38d7a3a5bc5813f70e12ea.exe	90
PID 3940 wrote to memory of 3604	3940	winver.exe	68
PID 3940 wrote to memory of 2632	3940	winver.exe	35
PID 3940 wrote to memory of 2648	3940	winver.exe	34
PID 3940 wrote to memory of 2968	3940	winver.exe	73

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2648

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3604
- C:\Users\Admin\AppData\Local\Temp\e6d1fa6afe38d7a3a5bc5813f70e12ea.exe
  "C:\Users\Admin\AppData\Local\Temp\e6d1fa6afe38d7a3a5bc5813f70e12ea.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3940

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2632-15-0x00000000004E0000-0x00000000004E6000-memory.dmp

Download

memory/2648-16-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/2648-12-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/2968-13-0x0000000000920000-0x0000000000926000-memory.dmp

Download

memory/3116-8-0x00000000024E0000-0x0000000002EE0000-memory.dmp

Download

memory/3116-3-0x00000000024E0000-0x0000000002EE0000-memory.dmp

Download

memory/3116-0-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/3116-7-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3604-2-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/3604-5-0x00007FFE7D8CD000-0x00007FFE7D8CE000-memory.dmp

Download

memory/3604-1-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/3736-17-0x00000000007D0000-0x00000000007D6000-memory.dmp

Download

memory/3940-4-0x0000000077642000-0x0000000077643000-memory.dmp

Download

memory/3940-6-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download