Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/01/2024, 02:48
General
- Target 223534841809356aa7c94f86e8b0f4d6b4ce317b8225b419b27a5ba320ab0b81.exe
- Size 110KB
- Sample240122-dahs7sefhk
- SHA256 223534841809356aa7c94f86e8b0f4d6b4ce317b8225b419b27a5ba320ab0b81
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of UnmapMainImage 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\223534841809356aa7c94f86e8b0f4d6b4ce317b8225b419b27a5ba320ab0b81.exe"C:\Users\Admin\AppData\Local\Temp\223534841809356aa7c94f86e8b0f4d6b4ce317b8225b419b27a5ba320ab0b81.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/788-30-0x0000000000F50000-0x0000000000F56000-memory.dmp
memory/1732-42-0x0000000000D10000-0x0000000000D16000-memory.dmp
memory/1732-38-0x0000000000D10000-0x0000000000D16000-memory.dmp
memory/2120-35-0x0000000000AB0000-0x0000000000AB6000-memory.dmp
memory/2120-32-0x0000000000AB0000-0x0000000000AB6000-memory.dmp
memory/2472-17-0x0000000000980000-0x0000000000986000-memory.dmp
memory/2524-18-0x0000000000E20000-0x0000000000E26000-memory.dmp
memory/2524-16-0x0000000000E20000-0x0000000000E26000-memory.dmp
memory/2608-34-0x00000000004B0000-0x00000000004B6000-memory.dmp
memory/2608-39-0x00000000004B0000-0x00000000004B6000-memory.dmp
memory/2624-40-0x0000000000700000-0x0000000000706000-memory.dmp
memory/2624-37-0x0000000000700000-0x0000000000706000-memory.dmp
memory/2672-23-0x00000000006A0000-0x00000000006A6000-memory.dmp
memory/2672-19-0x00000000006A0000-0x00000000006A6000-memory.dmp
memory/3076-29-0x0000000000E30000-0x0000000000E36000-memory.dmp
memory/3076-27-0x0000000000E30000-0x0000000000E36000-memory.dmp
memory/3084-31-0x00000000003F0000-0x00000000003F6000-memory.dmp
memory/3084-33-0x00000000003F0000-0x00000000003F6000-memory.dmp
memory/3260-2-0x0000000002360000-0x0000000002D60000-memory.dmp
memory/3260-12-0x0000000002360000-0x0000000002D60000-memory.dmp
memory/3260-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3260-1-0x00000000004F0000-0x00000000004F1000-memory.dmp
memory/3260-9-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3580-11-0x00007FF930720000-0x00007FF930721000-memory.dmp
memory/3580-7-0x00007FF9305AD000-0x00007FF9305AE000-memory.dmp
memory/3580-25-0x0000000002270000-0x0000000002276000-memory.dmp
memory/3580-20-0x0000000002270000-0x0000000002276000-memory.dmp
memory/3580-5-0x0000000000580000-0x0000000000586000-memory.dmp
memory/3580-10-0x00007FF930740000-0x00007FF930741000-memory.dmp
memory/3580-3-0x0000000000580000-0x0000000000586000-memory.dmp
memory/3712-26-0x0000000000D40000-0x0000000000D46000-memory.dmp
memory/3712-21-0x0000000000D40000-0x0000000000D46000-memory.dmp
memory/3908-22-0x0000000000B00000-0x0000000000B06000-memory.dmp
memory/4008-24-0x0000000000240000-0x0000000000246000-memory.dmp
memory/4008-28-0x0000000000240000-0x0000000000246000-memory.dmp
memory/4432-36-0x0000000000EB0000-0x0000000000EB6000-memory.dmp
memory/4432-44-0x0000000000EB0000-0x0000000000EB6000-memory.dmp
memory/4432-45-0x00007FF930730000-0x00007FF930731000-memory.dmp
memory/4496-41-0x00000000000B0000-0x00000000000B6000-memory.dmp
memory/4496-43-0x00000000000B0000-0x00000000000B6000-memory.dmp
memory/4956-6-0x00000000007F0000-0x00000000007F6000-memory.dmp
memory/4956-8-0x0000000076F02000-0x0000000076F03000-memory.dmp
memory/4956-4-0x0000000000CF0000-0x0000000000D02000-memory.dmp
memory/4956-14-0x00000000007F0000-0x00000000007F6000-memory.dmp