tinba | bb8264729a6ba947c398eaa2d45ab5b7bd721abe0a67d9b834a489af443cea30

Analysis

max time kernel
11s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a861069aa54044b63a3f688509abe3e.exe
Size 160KB
Sample231224-3rd9sagbb7
SHA256 bb8264729a6ba947c398eaa2d45ab5b7bd721abe0a67d9b834a489af443cea30
MD5 1a861069aa54044b63a3f688509abe3e
SHA1 c61bc58615ebebed6976d265f08098e6f84fdc9c
SHA512 8eb8436124acdea914e374fa32e9bb1b67846a7b70dee8288df85d02c3f584d2d872d416fa475e0eec00f853dd7e44bed26b2b4b878b0339d1f74990268f63f8
SSDEEP 1536:rEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:YY+4MiIkLZJNAQ9J6v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4556-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\378259E7 = "C:\\Users\\Admin\\AppData\\Roaming\\378259E7\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	winver.exe
1808	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	winver.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1808	4556	1a861069aa54044b63a3f688509abe3e.exe	89
PID 4556 wrote to memory of 1808	4556	1a861069aa54044b63a3f688509abe3e.exe	89
PID 4556 wrote to memory of 1808	4556	1a861069aa54044b63a3f688509abe3e.exe	89
PID 4556 wrote to memory of 1808	4556	1a861069aa54044b63a3f688509abe3e.exe	89
PID 1808 wrote to memory of 3380	1808	winver.exe	40
PID 1808 wrote to memory of 2536	1808	winver.exe	52
PID 1808 wrote to memory of 2552	1808	winver.exe	51
PID 1808 wrote to memory of 2768	1808	winver.exe	45
PID 1808 wrote to memory of 3380	1808	winver.exe	40
PID 1808 wrote to memory of 3508	1808	winver.exe	39
PID 1808 wrote to memory of 3756	1808	winver.exe	38

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3508

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3380
- C:\Users\Admin\AppData\Local\Temp\1a861069aa54044b63a3f688509abe3e.exe
  "C:\Users\Admin\AppData\Local\Temp\1a861069aa54044b63a3f688509abe3e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1808

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2552

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-7-0x0000000002750000-0x0000000002756000-memory.dmp

Download

memory/1808-5-0x0000000077D42000-0x0000000077D43000-memory.dmp

Download

memory/2536-15-0x0000000000780000-0x0000000000786000-memory.dmp

Download

memory/2552-17-0x00000000004A0000-0x00000000004A6000-memory.dmp

Download

memory/2552-13-0x00000000004A0000-0x00000000004A6000-memory.dmp

Download

memory/2768-14-0x00000000003C0000-0x00000000003C6000-memory.dmp

Download

memory/2768-19-0x00000000003C0000-0x00000000003C6000-memory.dmp

Download

memory/3380-3-0x0000000001430000-0x0000000001436000-memory.dmp

Download

memory/3380-21-0x0000000001470000-0x0000000001476000-memory.dmp

Download

memory/3380-6-0x00007FFB5D84D000-0x00007FFB5D84E000-memory.dmp

Download

memory/3380-16-0x0000000001470000-0x0000000001476000-memory.dmp

Download

memory/3380-2-0x0000000001430000-0x0000000001436000-memory.dmp

Download

memory/3508-18-0x0000000000190000-0x0000000000196000-memory.dmp

Download

memory/4556-4-0x0000000002390000-0x0000000002D90000-memory.dmp

Download

memory/4556-9-0x0000000002390000-0x0000000002D90000-memory.dmp

Download

memory/4556-8-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4556-1-0x0000000000470000-0x0000000000471000-memory.dmp

Download