Analysis
- max time kernel
151s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
24/02/2024, 19:36
General
- Target a2951a638042420c96dbfa17ed61e8d3.exe
- Size 89KB
- Sample240224-ybbfqsdd71
- SHA256 bba79a727693bfdd9f09acd42a1de97618e5c7507f440505a90e5944b3b738b9
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\a2951a638042420c96dbfa17ed61e8d3.exe"C:\Users\Admin\AppData\Local\Temp\a2951a638042420c96dbfa17ed61e8d3.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
- Modifies registry class
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
eventbeacons.dat
eventbeacons.dat
eventbeacons.dat.~tmp
02ea18b2d09644b9abcf69e750d98e2d_1
c313ca23ab744e68812a5253dfe67d1d_2
3685440855a647b7a48048bfcd50a46c_1
memory/464-58-0x0000000000FA0000-0x0000000000FA6000-memory.dmp
memory/1112-68-0x00000000006E0000-0x00000000006E6000-memory.dmp
memory/1456-64-0x00007FFEB7200000-0x00007FFEB7201000-memory.dmp
memory/1456-55-0x0000000000F00000-0x0000000000F06000-memory.dmp
memory/1456-56-0x0000000000F00000-0x0000000000F06000-memory.dmp
memory/1456-63-0x00007FFEB71F0000-0x00007FFEB71F1000-memory.dmp
memory/1456-66-0x00007FFEB71E0000-0x00007FFEB71E1000-memory.dmp
memory/2060-2-0x00000000021F0000-0x0000000002BF0000-memory.dmp
memory/2060-10-0x00000000021F0000-0x0000000002BF0000-memory.dmp
memory/2060-0-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2060-1-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/2060-9-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2072-123-0x0000000000200000-0x0000000000206000-memory.dmp
memory/2072-124-0x0000000000200000-0x0000000000206000-memory.dmp
memory/2120-40-0x0000000000EE0000-0x0000000000EE6000-memory.dmp
memory/2120-38-0x0000000000EE0000-0x0000000000EE6000-memory.dmp
memory/2120-54-0x00007FFEB7200000-0x00007FFEB7201000-memory.dmp
memory/2572-16-0x0000000000040000-0x0000000000046000-memory.dmp
memory/2660-18-0x0000000000E40000-0x0000000000E46000-memory.dmp
memory/2660-14-0x0000000000E40000-0x0000000000E46000-memory.dmp
memory/2732-35-0x0000000001520000-0x0000000001526000-memory.dmp
memory/2732-4-0x0000000001520000-0x0000000001526000-memory.dmp
memory/2732-7-0x0000000077BC2000-0x0000000077BC3000-memory.dmp
memory/2732-12-0x0000000001520000-0x0000000001526000-memory.dmp
memory/2768-22-0x0000000000900000-0x0000000000906000-memory.dmp
memory/2768-15-0x0000000000900000-0x0000000000906000-memory.dmp
memory/3004-74-0x0000000000560000-0x0000000000566000-memory.dmp
memory/3004-93-0x00007FFEB71F0000-0x00007FFEB71F1000-memory.dmp
memory/3004-75-0x0000000000560000-0x0000000000566000-memory.dmp
memory/3004-77-0x00007FFEB7200000-0x00007FFEB7201000-memory.dmp
memory/3264-37-0x0000000000EC0000-0x0000000000EC6000-memory.dmp
memory/3264-31-0x0000000000EC0000-0x0000000000EC6000-memory.dmp
memory/3368-20-0x0000000002610000-0x0000000002616000-memory.dmp
memory/3368-6-0x0000000002BE0000-0x0000000002BE6000-memory.dmp
memory/3368-8-0x00007FFEB706D000-0x00007FFEB706E000-memory.dmp
memory/3368-5-0x00007FFEB706D000-0x00007FFEB706E000-memory.dmp
memory/3368-3-0x0000000002BE0000-0x0000000002BE6000-memory.dmp
memory/3368-17-0x0000000002610000-0x0000000002616000-memory.dmp
memory/3368-73-0x00007FFEB7200000-0x00007FFEB7201000-memory.dmp
memory/3592-24-0x0000000000090000-0x0000000000096000-memory.dmp
memory/3592-19-0x0000000000090000-0x0000000000096000-memory.dmp
memory/3748-36-0x0000000000160000-0x0000000000166000-memory.dmp
memory/3748-39-0x0000000000160000-0x0000000000166000-memory.dmp
memory/3784-21-0x0000000000BA0000-0x0000000000BA6000-memory.dmp
memory/3940-26-0x0000000000A90000-0x0000000000A96000-memory.dmp
memory/3940-126-0x00007FFEB71F0000-0x00007FFEB71F1000-memory.dmp
memory/3940-23-0x0000000000A90000-0x0000000000A96000-memory.dmp
memory/3940-76-0x00007FFEB71E0000-0x00007FFEB71E1000-memory.dmp
memory/4004-27-0x00000000007E0000-0x00000000007E6000-memory.dmp
memory/4004-119-0x00007FFEB71E0000-0x00007FFEB71E1000-memory.dmp
memory/4004-25-0x00000000007E0000-0x00000000007E6000-memory.dmp
memory/4004-121-0x00007FFEB71F0000-0x00007FFEB71F1000-memory.dmp
memory/4004-120-0x00007FFEB7200000-0x00007FFEB7201000-memory.dmp
memory/4016-57-0x0000000000640000-0x0000000000646000-memory.dmp
memory/4092-28-0x0000000000F00000-0x0000000000F06000-memory.dmp
memory/4132-29-0x0000000000FD0000-0x0000000000FD6000-memory.dmp
memory/4132-32-0x0000000000FD0000-0x0000000000FD6000-memory.dmp
memory/4212-59-0x0000000000C70000-0x0000000000C76000-memory.dmp
memory/4212-60-0x0000000000C70000-0x0000000000C76000-memory.dmp
memory/4384-69-0x00000000008B0000-0x00000000008B6000-memory.dmp
memory/4428-30-0x00000000003F0000-0x00000000003F6000-memory.dmp
memory/4428-33-0x00000000003F0000-0x00000000003F6000-memory.dmp