tinba | 1abd57d4391c8b1c57151fa4c70acffe2ea6a3103d3c858b7dab57e4038cef22

Analysis

max time kernel
7s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe
Size 96KB
Sample240402-vhlcqsga48
SHA256 1abd57d4391c8b1c57151fa4c70acffe2ea6a3103d3c858b7dab57e4038cef22
MD5 922582ce2f868b82ad8df79811a8cbe9
SHA1 570baa3448db09cc44ad2ec1b5e3fc9eb6483dc6
SHA512 7bff97240acf5616798079c170b2a44bbec3e98a7db2114489c641604903b3b51aafb0fe10ea5cf89946924b8489ea3d33fa05d75ed30707e14adca46fe163d7
SSDEEP 1536:EiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:EiyvRmQKTLs/ZrwWJjAqGct
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0922D0B8 = "C:\\Users\\Admin\\AppData\\Roaming\\0922D0B8\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	winver.exe
2180	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	winver.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2180	5044	922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe	88
PID 5044 wrote to memory of 2180	5044	922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe	88
PID 5044 wrote to memory of 2180	5044	922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe	88
PID 5044 wrote to memory of 2180	5044	922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe	88
PID 2180 wrote to memory of 3472	2180	winver.exe	57
PID 2180 wrote to memory of 2492	2180	winver.exe	45
PID 2180 wrote to memory of 2580	2180	winver.exe	46
PID 2180 wrote to memory of 2772	2180	winver.exe	51
PID 2180 wrote to memory of 3472	2180	winver.exe	57
PID 2180 wrote to memory of 3636	2180	winver.exe	58
PID 2180 wrote to memory of 3816	2180	winver.exe	59

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2580

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2772

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\922582ce2f868b82ad8df79811a8cbe9_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-4-0x0000000077DC2000-0x0000000077DC3000-memory.dmp

Download

memory/2180-6-0x00000000023E0000-0x00000000023E6000-memory.dmp

Download

memory/2492-16-0x0000000000C30000-0x0000000000C36000-memory.dmp

Download

memory/2580-18-0x0000000000560000-0x0000000000566000-memory.dmp

Download

memory/2580-13-0x0000000000560000-0x0000000000566000-memory.dmp

Download

memory/2772-14-0x0000000000E40000-0x0000000000E46000-memory.dmp

Download

memory/3472-5-0x00007FF867A8D000-0x00007FF867A8E000-memory.dmp

Download

memory/3472-2-0x0000000000990000-0x0000000000996000-memory.dmp

Download

memory/3472-1-0x0000000000990000-0x0000000000996000-memory.dmp

Download

memory/3472-9-0x00007FF867C20000-0x00007FF867C21000-memory.dmp

Download

memory/3472-15-0x0000000000940000-0x0000000000946000-memory.dmp

Download

memory/3636-17-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/5044-7-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/5044-8-0x0000000002190000-0x0000000002B90000-memory.dmp

Download

memory/5044-0-0x0000000000540000-0x0000000000541000-memory.dmp

Download

memory/5044-3-0x0000000002190000-0x0000000002B90000-memory.dmp

Download