Analysis
- max time kernel
149s - max time network
145s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/05/2024, 22:23
General
- Target 0f5b712c4345c631d03f6b34fc73d2b0_NeikiAnalytics.exe
- Size 34KB
- Sample240509-2bae8adc23
- SHA256 695a1bab049e5c427d0fee2bdcd4fddd81a1bc04d95cd39fe189dbf5bd9d440d
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0f5b712c4345c631d03f6b34fc73d2b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f5b712c4345c631d03f6b34fc73d2b0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1076-27-0x0000000001FF0000-0x0000000001FF6000-memory.dmp
memory/1084-21-0x00000000001B0000-0x00000000001B6000-memory.dmp
memory/1084-25-0x0000000077A61000-0x0000000077A62000-memory.dmp
memory/1084-24-0x00000000001B0000-0x00000000001B6000-memory.dmp
memory/1156-3-0x0000000002A30000-0x0000000002A36000-memory.dmp
memory/1156-4-0x0000000002A30000-0x0000000002A36000-memory.dmp
memory/1156-2-0x0000000002A30000-0x0000000002A36000-memory.dmp
memory/1156-26-0x00000000025F0000-0x00000000025F6000-memory.dmp
memory/1156-10-0x0000000077A61000-0x0000000077A62000-memory.dmp
memory/1156-23-0x00000000025F0000-0x00000000025F6000-memory.dmp
memory/2736-7-0x0000000077C10000-0x0000000077C11000-memory.dmp
memory/2736-6-0x0000000000120000-0x0000000000126000-memory.dmp
memory/2736-8-0x0000000077C0F000-0x0000000077C10000-memory.dmp
memory/2736-9-0x0000000077C0F000-0x0000000077C11000-memory.dmp
memory/2736-11-0x0000000077A10000-0x0000000077BB9000-memory.dmp
memory/2736-31-0x0000000000120000-0x0000000000126000-memory.dmp
memory/2964-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2964-13-0x0000000001D40000-0x0000000002740000-memory.dmp
memory/2964-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2964-5-0x0000000001D40000-0x0000000002740000-memory.dmp
memory/2964-1-0x0000000000020000-0x0000000000021000-memory.dmp