Analysis
- max time kernel
132s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
23/06/2024, 15:09
General
- Target 037c2e9fff6289a0246ff287ca80484f02fff6a77b175793d3df0490217abafb_NeikiAnalytics.exe
- Size 45KB
- Sample240623-sjhbcsvhla
- SHA256 037c2e9fff6289a0246ff287ca80484f02fff6a77b175793d3df0490217abafb
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\037c2e9fff6289a0246ff287ca80484f02fff6a77b175793d3df0490217abafb_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\037c2e9fff6289a0246ff287ca80484f02fff6a77b175793d3df0490217abafb_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 3524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2100 -ip 21001⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2100-8-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/2100-15-0x0000000000B70000-0x0000000000B76000-memory.dmp
memory/2100-5-0x0000000000B70000-0x0000000000B76000-memory.dmp
memory/2100-6-0x00000000771D2000-0x00000000771D3000-memory.dmp
memory/2588-14-0x00000000001D0000-0x00000000001D6000-memory.dmp
memory/3364-2-0x0000000002CF0000-0x0000000002CF6000-memory.dmp
memory/3364-7-0x00007FFBBDAAD000-0x00007FFBBDAAE000-memory.dmp
memory/3364-3-0x0000000002CF0000-0x0000000002CF6000-memory.dmp
memory/5068-4-0x00000000021D0000-0x0000000002BD0000-memory.dmp
memory/5068-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/5068-9-0x0000000000400000-0x000000000041D000-memory.dmp
memory/5068-10-0x00000000021D0000-0x0000000002BD0000-memory.dmp
memory/5068-1-0x0000000002020000-0x0000000002021000-memory.dmp