tinba | 6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3

General

Target

6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe
Size

45KB
MD5

3762710c3ac312f5c087cb1b7731f063
SHA1

69d9d94eccc90900b53d8c80cb41ac95e30533a2
SHA256

6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3
SHA512

cb63a1d6b437c7b7bb5aced9dc84883dc6d66dd9fe7f38792bb1d6600ba2df4cf1f7f93480a6dd4c7c00bf0fcfd55dae82c1fff1c03f6529db4331611a04aaf1
SSDEEP

768:uhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:isWE9N5dFu53dsniQaB/xZ14n7zIF+qr

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000041D000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CA70E73B = "C:\\Users\\Admin\\AppData\\Roaming\\CA70E73B\\bin.exe"	winver.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3044 384 WerFault.exe winver.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

384 winver.exe
384 winver.exe

pid	pid_target	process	target process
3044	384	WerFault.exe	winver.exe

pid	process
384	winver.exe
384	winver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3448	Explorer.EXE
Token: SeCreatePagefilePrivilege	3448	Explorer.EXE
Token: SeShutdownPrivilege	3448	Explorer.EXE
Token: SeCreatePagefilePrivilege	3448	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

384 winver.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3448 Explorer.EXE

pid	process
384	winver.exe

pid	process
3448	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exewinver.exe

description	pid	process	target process
PID 4544 wrote to memory of 384	4544	6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe	winver.exe
PID 4544 wrote to memory of 384	4544	6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe	winver.exe
PID 4544 wrote to memory of 384	4544	6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe	winver.exe
PID 4544 wrote to memory of 384	4544	6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe	winver.exe
PID 384 wrote to memory of 3448	384	winver.exe	Explorer.EXE
PID 384 wrote to memory of 2912	384	winver.exe	sihost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2912

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3448

C:\Users\Admin\AppData\Local\Temp\6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe
"C:\Users\Admin\AppData\Local\Temp\6ce74ceeb4a121b9c8d9ef84e5d3579d8c45ae904b5bb95c80b4d32f864d07a3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 352
4⤵
- Program crash
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3060,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 384 -ip 384
1⤵
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-5-0x00000000775B2000-0x00000000775B3000-memory.dmp

Filesize
4KB

Download
memory/384-16-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download
memory/384-13-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download
memory/384-7-0x00007FFCCF470000-0x00007FFCCF665000-memory.dmp

Filesize
2.0MB

Download
memory/2912-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3448-6-0x00007FFCCF50D000-0x00007FFCCF50E000-memory.dmp

Filesize
4KB

Download
memory/3448-8-0x00007FFCCF6A0000-0x00007FFCCF6A1000-memory.dmp

Filesize
4KB

Download
memory/3448-2-0x0000000000950000-0x0000000000956000-memory.dmp

Filesize
24KB

Download
memory/3448-3-0x0000000000950000-0x0000000000956000-memory.dmp

Filesize
24KB

Download
memory/4544-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4544-4-0x0000000002150000-0x0000000002B50000-memory.dmp

Filesize
10.0MB

Download
memory/4544-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4544-11-0x0000000002150000-0x0000000002B50000-memory.dmp

Filesize
10.0MB

Download
memory/4544-1-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads