tinba | 1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe
Size 45KB
Sample240328-wbfpcacb6w
SHA256 1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a
MD5 01c1143eb5dbfa7d5aa8793e9ecd5419
SHA1 c61888f665c2595b1687f76cdbdd72edbf19aabe
SHA512 eef8489e6615b349ff0b4b222a2ece44db22707adc0174bd4719f01f45587e2f35a29e0a71b0eb5e6a075f3d3d3733a4563120ae7d4a383254a04c7d84517cba
SSDEEP 768:HhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:BsWE9N5dFu53dsniQaB/xZ14n7zIF+qr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4088-0-0x0000000000400000-0x000000000041D000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4088-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\037D8946 = "C:\\Users\\Admin\\AppData\\Roaming\\037D8946\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe
1104	winver.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3928	RuntimeBroker.exe
Token: SeShutdownPrivilege	3928	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1104	winver.exe
3188	Explorer.EXE
3188	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3188	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1104	4088	1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe	93
PID 4088 wrote to memory of 1104	4088	1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe	93
PID 4088 wrote to memory of 1104	4088	1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe	93
PID 4088 wrote to memory of 1104	4088	1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe	93
PID 1104 wrote to memory of 3188	1104	winver.exe	57
PID 1104 wrote to memory of 2392	1104	winver.exe	42
PID 1104 wrote to memory of 2408	1104	winver.exe	43
PID 1104 wrote to memory of 2488	1104	winver.exe	44
PID 1104 wrote to memory of 3188	1104	winver.exe	57
PID 1104 wrote to memory of 3496	1104	winver.exe	58
PID 1104 wrote to memory of 3720	1104	winver.exe	59
PID 1104 wrote to memory of 3820	1104	winver.exe	60
PID 1104 wrote to memory of 3928	1104	winver.exe	61
PID 1104 wrote to memory of 4036	1104	winver.exe	62
PID 1104 wrote to memory of 3456	1104	winver.exe	63
PID 1104 wrote to memory of 4512	1104	winver.exe	65
PID 1104 wrote to memory of 4944	1104	winver.exe	75
PID 1104 wrote to memory of 2456	1104	winver.exe	77
PID 1104 wrote to memory of 3988	1104	winver.exe	78
PID 1104 wrote to memory of 2448	1104	winver.exe	79
PID 1104 wrote to memory of 2120	1104	winver.exe	80
PID 1104 wrote to memory of 2824	1104	winver.exe	81
PID 1104 wrote to memory of 3568	1104	winver.exe	83
PID 1104 wrote to memory of 4912	1104	winver.exe	84
PID 1104 wrote to memory of 4400	1104	winver.exe	89
PID 1104 wrote to memory of 4508	1104	winver.exe	94
PID 1104 wrote to memory of 2208	1104	winver.exe	95
PID 1104 wrote to memory of 2540	1104	winver.exe	96
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108
PID 2456 wrote to memory of 2924	2456	msedge.exe	108

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2408

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3188
- C:\Users\Admin\AppData\Local\Temp\1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe
  "C:\Users\Admin\AppData\Local\Temp\1002762c4f5ce42db9789b08937175e138dc3b2b5aaf15e5a79a0a09fb4bfe9a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3496

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3720

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3820

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4036

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3456

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4512

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe66152e98,0x7ffe66152ea4,0x7ffe66152eb0
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2588 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5308 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5572 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2924

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2208

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-14-0x0000000002CC0000-0x0000000002CC6000-memory.dmp

Download

memory/1104-3-0x0000000000630000-0x0000000000642000-memory.dmp

Download

memory/1104-4-0x0000000002CC0000-0x0000000002CC6000-memory.dmp

Download

memory/1104-7-0x0000000077722000-0x0000000077723000-memory.dmp

Download

memory/2208-42-0x00000000009D0000-0x00000000009D6000-memory.dmp

Download

memory/2208-39-0x00000000009D0000-0x00000000009D6000-memory.dmp

Download

memory/2392-19-0x0000000000450000-0x0000000000456000-memory.dmp

Download

memory/2408-20-0x0000000000830000-0x0000000000836000-memory.dmp

Download

memory/2408-16-0x0000000000830000-0x0000000000836000-memory.dmp

Download

memory/2488-23-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Download

memory/2488-17-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Download

memory/2540-40-0x00000000007A0000-0x00000000007A6000-memory.dmp

Download

memory/2540-43-0x00000000007A0000-0x00000000007A6000-memory.dmp

Download

memory/3188-25-0x00000000012A0000-0x00000000012A6000-memory.dmp

Download

memory/3188-12-0x00007FFE8D6E0000-0x00007FFE8D6E1000-memory.dmp

Download

memory/3188-18-0x00000000012A0000-0x00000000012A6000-memory.dmp

Download

memory/3188-11-0x00007FFE8D700000-0x00007FFE8D701000-memory.dmp

Download

memory/3188-8-0x00007FFE8D56D000-0x00007FFE8D56E000-memory.dmp

Download

memory/3188-6-0x0000000002DE0000-0x0000000002DE6000-memory.dmp

Download

memory/3456-34-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/3456-31-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/3496-21-0x0000000000020000-0x0000000000026000-memory.dmp

Download

memory/3496-26-0x0000000000020000-0x0000000000026000-memory.dmp

Download

memory/3720-22-0x0000000000F40000-0x0000000000F46000-memory.dmp

Download

memory/3820-28-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/3820-24-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/3928-27-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/3928-29-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/4036-30-0x0000000000710000-0x0000000000716000-memory.dmp

Download

memory/4088-10-0x00000000022B0000-0x0000000002CB0000-memory.dmp

Download

memory/4088-0-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4088-9-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4088-2-0x00000000022B0000-0x0000000002CB0000-memory.dmp

Download

memory/4088-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/4400-35-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Download

memory/4400-46-0x00007FFE8D6F0000-0x00007FFE8D6F1000-memory.dmp

Download

memory/4400-45-0x00007FFE8D700000-0x00007FFE8D701000-memory.dmp

Download

memory/4400-44-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Download

memory/4508-38-0x0000000000E20000-0x0000000000E26000-memory.dmp

Download

memory/4508-41-0x0000000000E20000-0x0000000000E26000-memory.dmp

Download

memory/4512-32-0x0000000000040000-0x0000000000046000-memory.dmp

Download

memory/4512-36-0x0000000000040000-0x0000000000046000-memory.dmp

Download

memory/4944-33-0x0000000000560000-0x0000000000566000-memory.dmp

Download

memory/4944-37-0x0000000000560000-0x0000000000566000-memory.dmp

Download