tinba | 18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f

General

Target

18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe
Size

225KB
MD5

76035336faea145a7a0d0feccc54ff20
SHA1

01c16470d8fa0e5774dd65e99b7750883bca21c7
SHA256

18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f
SHA512

cfb4aafc330f9d3b40834bff73fbafa49dad910ae7816a854f8495025601f02ee2b30f898d92aade599c687507afb902d1059e9031b5755a8c9461dcfad8b9ed
SSDEEP

6144:gA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:gATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\A3036EAD = "C:\\Users\\Admin\\AppData\\Roaming\\A3036EAD\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

pid	process
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe
2840	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2840 winver.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 2740 wrote to memory of 2840	2740	18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe	winver.exe
PID 2740 wrote to memory of 2840	2740	18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe	winver.exe
PID 2740 wrote to memory of 2840	2740	18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe	winver.exe
PID 2740 wrote to memory of 2840	2740	18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe	winver.exe
PID 2740 wrote to memory of 2840	2740	18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe	winver.exe
PID 2840 wrote to memory of 1184	2840	winver.exe	Explorer.EXE
PID 2840 wrote to memory of 1100	2840	winver.exe	taskhost.exe
PID 2840 wrote to memory of 1160	2840	winver.exe	Dwm.exe
PID 2840 wrote to memory of 1184	2840	winver.exe	Explorer.EXE

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184

C:\Users\Admin\AppData\Local\Temp\18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18bf6bedc96b1e62037514e6232343b44949d11e005500ea6cb4a8d95c63d12f_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-21-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1100-11-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1160-14-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/1160-22-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/1184-1-0x00000000024A0000-0x00000000024A6000-memory.dmp

Filesize
24KB

Download
memory/1184-17-0x00000000024F0000-0x00000000024F6000-memory.dmp

Filesize
24KB

Download
memory/1184-6-0x00000000024A0000-0x00000000024A6000-memory.dmp

Filesize
24KB

Download
memory/1184-23-0x00000000024F0000-0x00000000024F6000-memory.dmp

Filesize
24KB

Download
memory/1184-3-0x00000000024A0000-0x00000000024A6000-memory.dmp

Filesize
24KB

Download
memory/2740-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2840-20-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2840-4-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2840-25-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads