tinba | b026a23885f2b8dc5290341ab0238b7e9e9d83ba5763c38ab1be3349cf26b91b

Analysis

max time kernel
34s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9700d52eee596275d20e7c96dc4073be.exe
Size 103KB
Sample231222-qa671sdddl
SHA256 b026a23885f2b8dc5290341ab0238b7e9e9d83ba5763c38ab1be3349cf26b91b
MD5 9700d52eee596275d20e7c96dc4073be
SHA1 dabc686c17a220ad5aba1267da9deb1f6c9bfb26
SHA512 d3ef69f22741c2c6592ba633c7330fe6c7e2f3159794ab25b1e05b2e7597527ebddba0dbf574d380dd5720ddcb6c2038f7b5807e08240d532fc61599a72f58a1
SSDEEP 1536:YPx+riFFG1M/m3wEYQqjh+rmKVsMiVPWIM8SZ:yYwFEgjwqWsMMXMx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4872-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\774F5904 = "C:\\Users\\Admin\\AppData\\Roaming\\774F5904\\bin.exe"	winver.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4196	4704	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	winver.exe
4704	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3340	Explorer.EXE
Token: SeCreatePagefilePrivilege	3340	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4704	winver.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4704	4872	9700d52eee596275d20e7c96dc4073be.exe	89
PID 4872 wrote to memory of 4704	4872	9700d52eee596275d20e7c96dc4073be.exe	89
PID 4872 wrote to memory of 4704	4872	9700d52eee596275d20e7c96dc4073be.exe	89
PID 4872 wrote to memory of 4704	4872	9700d52eee596275d20e7c96dc4073be.exe	89
PID 4704 wrote to memory of 3340	4704	winver.exe	51
PID 4704 wrote to memory of 2760	4704	winver.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340
- C:\Users\Admin\AppData\Local\Temp\9700d52eee596275d20e7c96dc4073be.exe
  "C:\Users\Admin\AppData\Local\Temp\9700d52eee596275d20e7c96dc4073be.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 352
      4⤵
      Program crash
      PID:4196

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4704 -ip 4704
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-12-0x0000000000080000-0x0000000000086000-memory.dmp

Download

memory/2760-17-0x00007FFB57ED0000-0x00007FFB57ED1000-memory.dmp

Download

memory/3340-6-0x00007FFB57D4D000-0x00007FFB57D4E000-memory.dmp

Download

memory/3340-2-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/3340-3-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/3340-15-0x00007FFB57EE0000-0x00007FFB57EE1000-memory.dmp

Download

memory/3340-16-0x00007FFB57EC0000-0x00007FFB57EC1000-memory.dmp

Download

memory/4704-5-0x0000000077522000-0x0000000077523000-memory.dmp

Download

memory/4704-7-0x0000000001100000-0x0000000001106000-memory.dmp

Download

memory/4704-13-0x0000000001100000-0x0000000001106000-memory.dmp

Download

memory/4872-4-0x0000000002680000-0x0000000003080000-memory.dmp

Download

memory/4872-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4872-8-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4872-1-0x0000000000680000-0x0000000000681000-memory.dmp

Download