Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2024 03:36

General

  • Target

    723f9d82071030d1cc7600a56204d5b0_NeikiAnalytics.exe

  • Size

    225KB

  • MD5

    723f9d82071030d1cc7600a56204d5b0

  • SHA1

    ed32be51f7e7b51cd7b8ca9f12d87978fbab797e

  • SHA256

    a22793648b9ed4c848165ed3ac478919ec6453a9fb8937b368b488b6f0140d95

  • SHA512

    6589813807a11b44d0c1d1ce2b7550a8b9fe23160d4a5705a3aa6052cb11b0ee21820eae644e66e49c87df79024c9b0135a8ffd2592014a08b4cf9d784ced1e7

  • SSDEEP

    6144:fA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:fATuTAnKGwUAW3ycQqgf

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1108
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1212
          • C:\Users\Admin\AppData\Local\Temp\723f9d82071030d1cc7600a56204d5b0_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\723f9d82071030d1cc7600a56204d5b0_NeikiAnalytics.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Windows\SysWOW64\winver.exe
              winver
              3⤵
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2744

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Modify Registry

        1
        T1112

        Discovery

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1108-23-0x0000000001F90000-0x0000000001F96000-memory.dmp
          Filesize

          24KB

        • memory/1108-9-0x0000000001F90000-0x0000000001F96000-memory.dmp
          Filesize

          24KB

        • memory/1164-12-0x00000000001B0000-0x00000000001B6000-memory.dmp
          Filesize

          24KB

        • memory/1164-25-0x00000000001B0000-0x00000000001B6000-memory.dmp
          Filesize

          24KB

        • memory/1212-1-0x0000000002560000-0x0000000002566000-memory.dmp
          Filesize

          24KB

        • memory/1212-15-0x00000000025A0000-0x00000000025A6000-memory.dmp
          Filesize

          24KB

        • memory/1212-6-0x0000000002560000-0x0000000002566000-memory.dmp
          Filesize

          24KB

        • memory/1212-3-0x0000000002560000-0x0000000002566000-memory.dmp
          Filesize

          24KB

        • memory/1212-24-0x00000000025A0000-0x00000000025A6000-memory.dmp
          Filesize

          24KB

        • memory/2744-20-0x0000000000410000-0x0000000000416000-memory.dmp
          Filesize

          24KB

        • memory/2744-4-0x0000000000320000-0x0000000000326000-memory.dmp
          Filesize

          24KB

        • memory/2744-27-0x0000000000410000-0x0000000000416000-memory.dmp
          Filesize

          24KB

        • memory/2880-22-0x0000000000400000-0x000000000043C000-memory.dmp
          Filesize

          240KB