Analysis
- max time kernel
146s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
06/05/2024, 23:21
General
- Target 2f73a5de56739f1cd3adf10c303d8fa0_NEAS.exe
- Size 45KB
- Sample240506-3b3mfaba55
- SHA256 f4328b9d949f6a9a5f3865d5ba97eeab11d6988cc6fe3f201a9ac7a765ec5361
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\2f73a5de56739f1cd3adf10c303d8fa0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\2f73a5de56739f1cd3adf10c303d8fa0_NEAS.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 3524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2876 -ip 28761⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2600-14-0x00000000005A0000-0x00000000005A6000-memory.dmp
memory/2876-5-0x0000000077D12000-0x0000000077D13000-memory.dmp
memory/2876-15-0x0000000000DE0000-0x0000000000DE6000-memory.dmp
memory/2876-12-0x0000000000DE0000-0x0000000000DE6000-memory.dmp
memory/2876-7-0x00007FF8B0810000-0x00007FF8B0A05000-memory.dmp
memory/3400-10-0x0000000000400000-0x000000000041D000-memory.dmp
memory/3400-4-0x00000000021A0000-0x0000000002BA0000-memory.dmp
memory/3400-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/3400-1-0x0000000002020000-0x0000000002021000-memory.dmp
memory/3600-6-0x00007FF8B08AD000-0x00007FF8B08AE000-memory.dmp
memory/3600-8-0x00007FF8B0A40000-0x00007FF8B0A41000-memory.dmp
memory/3600-3-0x0000000000700000-0x0000000000706000-memory.dmp
memory/3600-2-0x0000000000700000-0x0000000000706000-memory.dmp