Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 20:42

General

  • Target

    34b8d1f97fc49f1e045ddd0bce268880_NeikiAnalytics.exe

  • Size

    237KB

  • MD5

    34b8d1f97fc49f1e045ddd0bce268880

  • SHA1

    aa83b2e1d3fbcf95ff5a4ee1fd0a7f8dd3a3cce9

  • SHA256

    7700dda53886217863d72dd813e2a9c9b890b0e3dde2ad755d102fb4d1290259

  • SHA512

    846f7cc28ba8b3122c55ea40bbf10681408c79911e3a952ffd44fd3608fa5e018306f96fa17831ca361c6947e3a6d88eb3a30c1387043df083868145ae7e9b13

  • SSDEEP

    6144:6A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:6ATuTAnKGwUAWVycQqgj

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1060
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1188
        • C:\Users\Admin\AppData\Local\Temp\34b8d1f97fc49f1e045ddd0bce268880_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\34b8d1f97fc49f1e045ddd0bce268880_NeikiAnalytics.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1740
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2664

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1060-23-0x0000000000210000-0x0000000000216000-memory.dmp
        Filesize

        24KB

      • memory/1060-11-0x0000000000210000-0x0000000000216000-memory.dmp
        Filesize

        24KB

      • memory/1164-14-0x0000000000390000-0x0000000000396000-memory.dmp
        Filesize

        24KB

      • memory/1164-21-0x0000000000390000-0x0000000000396000-memory.dmp
        Filesize

        24KB

      • memory/1188-6-0x0000000002DF0000-0x0000000002DF6000-memory.dmp
        Filesize

        24KB

      • memory/1188-17-0x0000000002F00000-0x0000000002F06000-memory.dmp
        Filesize

        24KB

      • memory/1188-3-0x0000000002DF0000-0x0000000002DF6000-memory.dmp
        Filesize

        24KB

      • memory/1188-1-0x0000000002DF0000-0x0000000002DF6000-memory.dmp
        Filesize

        24KB

      • memory/1188-22-0x0000000002F00000-0x0000000002F06000-memory.dmp
        Filesize

        24KB

      • memory/1740-8-0x0000000000400000-0x000000000043F000-memory.dmp
        Filesize

        252KB

      • memory/2664-20-0x00000000002B0000-0x00000000002B6000-memory.dmp
        Filesize

        24KB

      • memory/2664-4-0x0000000000130000-0x0000000000136000-memory.dmp
        Filesize

        24KB

      • memory/2664-25-0x00000000002B0000-0x00000000002B6000-memory.dmp
        Filesize

        24KB