Analysis
- max time kernel
146s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
07/05/2024, 01:38
General
- Target d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c.exe
- Size 45KB
- Sample240507-b2srdacf5z
- SHA256 d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX dump on OEP (original entry point) 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c.exe"C:\Users\Admin\AppData\Local\Temp\d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 3524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2440 -ip 24401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2440-6-0x0000000077072000-0x0000000077073000-memory.dmp
memory/2440-18-0x0000000000530000-0x0000000000536000-memory.dmp
memory/2440-8-0x00007FFAB2FF0000-0x00007FFAB31E5000-memory.dmp
memory/2440-5-0x0000000000530000-0x0000000000536000-memory.dmp
memory/2648-17-0x0000000000440000-0x0000000000446000-memory.dmp
memory/3476-2-0x0000000000E90000-0x0000000000E96000-memory.dmp
memory/3476-7-0x00007FFAB308D000-0x00007FFAB308E000-memory.dmp
memory/3476-9-0x00007FFAB3220000-0x00007FFAB3221000-memory.dmp
memory/3476-13-0x00007FFAB3200000-0x00007FFAB3201000-memory.dmp
memory/3476-3-0x0000000000E90000-0x0000000000E96000-memory.dmp
memory/4256-4-0x0000000002220000-0x0000000002C20000-memory.dmp
memory/4256-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4256-11-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4256-12-0x0000000002220000-0x0000000002C20000-memory.dmp
memory/4256-1-0x0000000000680000-0x0000000000681000-memory.dmp