tinba | 0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a

General

Target

0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe
Size

45KB
MD5

00f038ba4010f321facad17dcd8082b0
SHA1

36839cc4d461e4ca547841eec5db43d28e1ee053
SHA256

0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a
SHA512

91dfa5402f5034eeeec654cf4a600a5bebc925b774cffbffe85080067a343283810648f99467d881f723973cfecbf43971029ba3b0f5fba6bfe28e39fc6bf3b9
SSDEEP

768:LhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:tsWE9N5dFu53dsniQaB/xZ14n7zIF+qr

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2072-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\1EC7BA95 = "C:\\Users\\Admin\\AppData\\Roaming\\1EC7BA95\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe
1644	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

1644 winver.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 2072 wrote to memory of 1644	2072	0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe	winver.exe
PID 2072 wrote to memory of 1644	2072	0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe	winver.exe
PID 2072 wrote to memory of 1644	2072	0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe	winver.exe
PID 2072 wrote to memory of 1644	2072	0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe	winver.exe
PID 2072 wrote to memory of 1644	2072	0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe	winver.exe
PID 1644 wrote to memory of 1180	1644	winver.exe	Explorer.EXE
PID 1644 wrote to memory of 1056	1644	winver.exe	taskhost.exe
PID 1644 wrote to memory of 1088	1644	winver.exe	Dwm.exe
PID 1644 wrote to memory of 1180	1644	winver.exe	Explorer.EXE

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1056

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0acdb069dcbb0d4a84d04d1b9e556ec7a1a1665bc534cd687877ffd4bba05b9a_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-25-0x0000000077491000-0x0000000077492000-memory.dmp

Filesize
4KB

Download
memory/1056-24-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/1088-21-0x0000000001DA0000-0x0000000001DA6000-memory.dmp

Filesize
24KB

Download
memory/1088-26-0x0000000001DA0000-0x0000000001DA6000-memory.dmp

Filesize
24KB

Download
memory/1180-10-0x0000000077491000-0x0000000077492000-memory.dmp

Filesize
4KB

Download
memory/1180-23-0x0000000002E60000-0x0000000002E66000-memory.dmp

Filesize
24KB

Download
memory/1180-27-0x0000000002E60000-0x0000000002E66000-memory.dmp

Filesize
24KB

Download
memory/1180-4-0x0000000002EB0000-0x0000000002EB6000-memory.dmp

Filesize
24KB

Download
memory/1180-3-0x0000000002EB0000-0x0000000002EB6000-memory.dmp

Filesize
24KB

Download
memory/1180-2-0x0000000002EB0000-0x0000000002EB6000-memory.dmp

Filesize
24KB

Download
memory/1644-9-0x000000007763F000-0x0000000077641000-memory.dmp

Filesize
8KB

Download
memory/1644-11-0x0000000077440000-0x00000000775E9000-memory.dmp

Filesize
1.7MB

Download
memory/1644-8-0x000000007763F000-0x0000000077640000-memory.dmp

Filesize
4KB

Download
memory/1644-7-0x0000000077640000-0x0000000077641000-memory.dmp

Filesize
4KB

Download
memory/1644-6-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/1644-31-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1644-32-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2072-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2072-13-0x0000000001D30000-0x0000000002730000-memory.dmp

Filesize
10.0MB

Download
memory/2072-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2072-5-0x0000000001D30000-0x0000000002730000-memory.dmp

Filesize
10.0MB

Download
memory/2072-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads