Analysis
- max time kernel
7s - max time network
8s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/04/2024, 02:48
General
- Target ca6aa3415af99e09601321e6b81030c54f2fb10a199f28a88e2d699949832ecd.exe
- Size 45KB
- Sample240402-dayvesee2w
- SHA256 ca6aa3415af99e09601321e6b81030c54f2fb10a199f28a88e2d699949832ecd
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX dump on OEP (original entry point) 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\ca6aa3415af99e09601321e6b81030c54f2fb10a199f28a88e2d699949832ecd.exe"C:\Users\Admin\AppData\Local\Temp\ca6aa3415af99e09601321e6b81030c54f2fb10a199f28a88e2d699949832ecd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2520-20-0x0000000000160000-0x0000000000166000-memory.dmp
memory/2684-21-0x00000000006B0000-0x00000000006B6000-memory.dmp
memory/2684-17-0x00000000006B0000-0x00000000006B6000-memory.dmp
memory/2776-12-0x0000000002320000-0x0000000002D20000-memory.dmp
memory/2776-1-0x0000000002160000-0x0000000002161000-memory.dmp
memory/2776-4-0x0000000002320000-0x0000000002D20000-memory.dmp
memory/2776-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2776-11-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2872-18-0x00000000004B0000-0x00000000004B6000-memory.dmp
memory/3364-5-0x0000000000AA0000-0x0000000000AA6000-memory.dmp
memory/3364-6-0x0000000077272000-0x0000000077273000-memory.dmp
memory/3364-9-0x0000000000CC0000-0x0000000000CD2000-memory.dmp
memory/3368-3-0x0000000002EB0000-0x0000000002EB6000-memory.dmp
memory/3368-13-0x00007FFE19FC0000-0x00007FFE19FC1000-memory.dmp
memory/3368-10-0x00007FFE19FE0000-0x00007FFE19FE1000-memory.dmp
memory/3368-7-0x00007FFE19E4D000-0x00007FFE19E4E000-memory.dmp
memory/3368-8-0x00007FFE19E4C000-0x00007FFE19E4D000-memory.dmp
memory/3368-2-0x0000000002EB0000-0x0000000002EB6000-memory.dmp
memory/3556-22-0x0000000000050000-0x0000000000056000-memory.dmp