Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 19:12

General

  • Target

    143316d354e4bc091fccb77b288c9341bc67abc50fcdf6e0076032607a209b93.exe

  • Size

    106KB

  • MD5

    eed815d9da5d8c69d3ea5e8029afa0a6

  • SHA1

    2aced5a5c65df81c1bb4bda1a09abab50a37f13f

  • SHA256

    143316d354e4bc091fccb77b288c9341bc67abc50fcdf6e0076032607a209b93

  • SHA512

    13a9cbe0ec766e0d04b5495babb4ea80e74ac02e7baf10fa07b196c5d9795b0667cbb466fc853a4b696a08a46760a7ecab54173437a3cf5fab6a5f0309656875

  • SSDEEP

    768:0+6p+OMlgGXCWhfDzU7f0JDgi9I57+sByZ+XsfXpwtG9ipelU9JA:0+mFM2QXtZgi9Iksu+XM57ipeq9JA

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1216
          • C:\Users\Admin\AppData\Local\Temp\143316d354e4bc091fccb77b288c9341bc67abc50fcdf6e0076032607a209b93.exe
            "C:\Users\Admin\AppData\Local\Temp\143316d354e4bc091fccb77b288c9341bc67abc50fcdf6e0076032607a209b93.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3016
            • C:\Windows\SysWOW64\winver.exe
              winver
              3⤵
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3044

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Modify Registry

        1
        T1112

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1112-24-0x0000000076FE1000-0x0000000076FE2000-memory.dmp
          Filesize

          4KB

        • memory/1112-23-0x0000000002130000-0x0000000002136000-memory.dmp
          Filesize

          24KB

        • memory/1164-20-0x0000000000130000-0x0000000000136000-memory.dmp
          Filesize

          24KB

        • memory/1164-26-0x0000000000130000-0x0000000000136000-memory.dmp
          Filesize

          24KB

        • memory/1216-3-0x0000000002560000-0x0000000002566000-memory.dmp
          Filesize

          24KB

        • memory/1216-4-0x0000000002560000-0x0000000002566000-memory.dmp
          Filesize

          24KB

        • memory/1216-2-0x0000000002560000-0x0000000002566000-memory.dmp
          Filesize

          24KB

        • memory/1216-25-0x00000000020D0000-0x00000000020D6000-memory.dmp
          Filesize

          24KB

        • memory/1216-10-0x0000000076FE1000-0x0000000076FE2000-memory.dmp
          Filesize

          4KB

        • memory/1216-22-0x00000000020D0000-0x00000000020D6000-memory.dmp
          Filesize

          24KB

        • memory/3016-5-0x0000000001B60000-0x0000000002560000-memory.dmp
          Filesize

          10.0MB

        • memory/3016-12-0x0000000000400000-0x000000000041C000-memory.dmp
          Filesize

          112KB

        • memory/3016-13-0x0000000001B60000-0x0000000002560000-memory.dmp
          Filesize

          10.0MB

        • memory/3016-0-0x0000000000400000-0x000000000041C000-memory.dmp
          Filesize

          112KB

        • memory/3016-1-0x0000000000020000-0x0000000000021000-memory.dmp
          Filesize

          4KB

        • memory/3044-6-0x0000000000120000-0x0000000000126000-memory.dmp
          Filesize

          24KB

        • memory/3044-7-0x0000000077190000-0x0000000077191000-memory.dmp
          Filesize

          4KB

        • memory/3044-11-0x0000000076F90000-0x0000000077139000-memory.dmp
          Filesize

          1.7MB

        • memory/3044-8-0x000000007718F000-0x0000000077190000-memory.dmp
          Filesize

          4KB

        • memory/3044-9-0x000000007718F000-0x0000000077191000-memory.dmp
          Filesize

          8KB

        • memory/3044-30-0x0000000000120000-0x0000000000126000-memory.dmp
          Filesize

          24KB