Analysis
- max time kernel
91s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/12/2023, 18:31
General
- Target 008a3c8140ee60accd92226ae42e19f4.exe
- Size 160KB
- Sample231229-w6aftaahcl
- SHA256 3b561264906f1c7cdae34d4b8d4467a76e5f49b48863a6ef140b4f5d0a860665
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\008a3c8140ee60accd92226ae42e19f4.exe"C:\Users\Admin\AppData\Local\Temp\008a3c8140ee60accd92226ae42e19f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2784-6-0x0000000002560000-0x0000000002566000-memory.dmp
memory/2784-7-0x0000000077982000-0x0000000077983000-memory.dmp
memory/2832-18-0x00000000007E0000-0x00000000007E6000-memory.dmp
memory/2852-1-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2852-2-0x0000000002170000-0x0000000002171000-memory.dmp
memory/2852-3-0x0000000002280000-0x0000000002C80000-memory.dmp
memory/2852-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2852-10-0x0000000002280000-0x0000000002C80000-memory.dmp
memory/2936-15-0x0000000000E10000-0x0000000000E16000-memory.dmp
memory/2936-19-0x0000000000E10000-0x0000000000E16000-memory.dmp
memory/3044-16-0x0000000000750000-0x0000000000756000-memory.dmp
memory/3044-22-0x0000000000750000-0x0000000000756000-memory.dmp
memory/3376-13-0x00007FFE26F00000-0x00007FFE26F01000-memory.dmp
memory/3376-4-0x0000000000910000-0x0000000000916000-memory.dmp
memory/3376-8-0x00007FFE26D6D000-0x00007FFE26D6E000-memory.dmp
memory/3376-5-0x0000000000910000-0x0000000000916000-memory.dmp
memory/3376-17-0x0000000000920000-0x0000000000926000-memory.dmp
memory/3556-20-0x0000000000AF0000-0x0000000000AF6000-memory.dmp