tinba | 83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878

General

Target

83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe
Size

32KB
MD5

7c639424b1d7c058a2f8f38850821520
SHA1

88cf6580e9328e752a12b65265f78666dfbb84c6
SHA256

83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878
SHA512

5eb054ca991d06b1f5b7ccce1718580108f234c087e4177ee5c7b7be71b7e27882ab749a035044f402d4c29fa6295fec9843a0207e82cb43d76ce1529cd3ceb6
SSDEEP

768:RtkSEpBYWOqpRz+Oza7hYUtXz8z7nIV9dr2V9r7Dk9J:LkBpvTz+B7xYY/KV9Q9J

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\18AAA22A = "C:\\Users\\Admin\\AppData\\Roaming\\18AAA22A\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe
2016	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2016 winver.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 2316 wrote to memory of 2016	2316	83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe	winver.exe
PID 2316 wrote to memory of 2016	2316	83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe	winver.exe
PID 2316 wrote to memory of 2016	2316	83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe	winver.exe
PID 2316 wrote to memory of 2016	2316	83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe	winver.exe
PID 2316 wrote to memory of 2016	2316	83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe	winver.exe
PID 2016 wrote to memory of 1368	2016	winver.exe	Explorer.EXE
PID 2016 wrote to memory of 1244	2016	winver.exe	taskhost.exe
PID 2016 wrote to memory of 1336	2016	winver.exe	Dwm.exe
PID 2016 wrote to memory of 1368	2016	winver.exe	Explorer.EXE

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1244

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368

C:\Users\Admin\AppData\Local\Temp\83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\83f88258bdb36779470dcb270f545e5f2074ebfe46bfbf6206f3a6215fc57878_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2016

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-25-0x0000000076E21000-0x0000000076E22000-memory.dmp

Filesize
4KB

Download
memory/1244-24-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download
memory/1336-21-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/1336-27-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/1368-3-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/1368-4-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/1368-2-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/1368-26-0x0000000002930000-0x0000000002936000-memory.dmp

Filesize
24KB

Download
memory/1368-23-0x0000000002930000-0x0000000002936000-memory.dmp

Filesize
24KB

Download
memory/1368-10-0x0000000076E21000-0x0000000076E22000-memory.dmp

Filesize
4KB

Download
memory/2016-11-0x0000000076DD0000-0x0000000076F79000-memory.dmp

Filesize
1.7MB

Download
memory/2016-9-0x0000000076FCF000-0x0000000076FD1000-memory.dmp

Filesize
8KB

Download
memory/2016-6-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2016-7-0x0000000076FD0000-0x0000000076FD1000-memory.dmp

Filesize
4KB

Download
memory/2016-8-0x0000000076FCF000-0x0000000076FD0000-memory.dmp

Filesize
4KB

Download
memory/2016-31-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2316-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2316-13-0x0000000001D10000-0x0000000002710000-memory.dmp

Filesize
10.0MB

Download
memory/2316-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2316-5-0x0000000001D10000-0x0000000002710000-memory.dmp

Filesize
10.0MB

Download
memory/2316-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads