tinba | 13a1e0e0a10ce4f9539846bf98f6b1d80c33fee337349843fba5f7526fae9795

Analysis

max time kernel
7s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a97bc946be4523289bf0c9a1ac361297.exe
Size 89KB
Sample240227-spzgtscc38
SHA256 13a1e0e0a10ce4f9539846bf98f6b1d80c33fee337349843fba5f7526fae9795
MD5 a97bc946be4523289bf0c9a1ac361297
SHA1 edbfad91b4896aed5023c32998a8e0fb0064f16e
SHA512 402f38c9bf4ef380d463b172be1fa7dfb1d0fc417b0783fab96b283535966e5cc8e94e927bca796a1ea20cea7edd9e4d219670215ff64af0dbf98e41f0d753ad
SSDEEP 1536:sL+mFM2HXKZgiwIksu+XM5/HtAQ9JB9p03:u+4MOIkLZJNAQ9JBjq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4ED4A85E = "C:\\Users\\Admin\\AppData\\Roaming\\4ED4A85E\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
616	winver.exe
616	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
616	winver.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 616	4836	a97bc946be4523289bf0c9a1ac361297.exe	85
PID 4836 wrote to memory of 616	4836	a97bc946be4523289bf0c9a1ac361297.exe	85
PID 4836 wrote to memory of 616	4836	a97bc946be4523289bf0c9a1ac361297.exe	85
PID 4836 wrote to memory of 616	4836	a97bc946be4523289bf0c9a1ac361297.exe	85
PID 616 wrote to memory of 3256	616	winver.exe	41
PID 616 wrote to memory of 2412	616	winver.exe	49
PID 616 wrote to memory of 2428	616	winver.exe	48
PID 616 wrote to memory of 2572	616	winver.exe	44

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3256
- C:\Users\Admin\AppData\Local\Temp\a97bc946be4523289bf0c9a1ac361297.exe
  "C:\Users\Admin\AppData\Local\Temp\a97bc946be4523289bf0c9a1ac361297.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:616

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2428

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-4-0x0000000001480000-0x0000000001486000-memory.dmp

Download

memory/616-12-0x0000000001480000-0x0000000001486000-memory.dmp

Download

memory/616-6-0x0000000077302000-0x0000000077303000-memory.dmp

Download

memory/2428-14-0x0000000000220000-0x0000000000226000-memory.dmp

Download

memory/2572-15-0x0000000000410000-0x0000000000416000-memory.dmp

Download

memory/2572-21-0x0000000000410000-0x0000000000416000-memory.dmp

Download

memory/3256-3-0x0000000000C40000-0x0000000000C46000-memory.dmp

Download

memory/3256-7-0x00007FFD37A0D000-0x00007FFD37A0E000-memory.dmp

Download

memory/3256-5-0x0000000000C40000-0x0000000000C46000-memory.dmp

Download

memory/3256-10-0x00007FFD37BA0000-0x00007FFD37BA1000-memory.dmp

Download

memory/3492-19-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/4836-2-0x0000000002280000-0x0000000002C80000-memory.dmp

Download

memory/4836-8-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4836-9-0x0000000002280000-0x0000000002C80000-memory.dmp

Download

memory/4836-1-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/4836-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download