tinba | 37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e

General

Target

37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe
Size

98KB
MD5

ae8090e15aa8d3bc8c44ec453d74f610
SHA1

f49b32774057acc4ef4f69548a9c40f568831861
SHA256

37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e
SHA512

3ea3760d3d59356ffd404ccc592b009705ecf0092c7f31b23cdaa144aedf2cc2994eff8c150e91c3bfe2a545ba4f8139be6c1c289b034a4fc4a387b9a7284f8d
SSDEEP

768:L+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:L+mFM2HXKZgi9Iksu+XM57ipeq9JF

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\4FB0A5ED = "C:\\Users\\Admin\\AppData\\Roaming\\4FB0A5ED\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe
3016	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

3016 winver.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 1792 wrote to memory of 3016	1792	37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe	winver.exe
PID 1792 wrote to memory of 3016	1792	37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe	winver.exe
PID 1792 wrote to memory of 3016	1792	37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe	winver.exe
PID 1792 wrote to memory of 3016	1792	37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe	winver.exe
PID 1792 wrote to memory of 3016	1792	37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe	winver.exe
PID 3016 wrote to memory of 1196	3016	winver.exe	Explorer.EXE
PID 3016 wrote to memory of 1120	3016	winver.exe	taskhost.exe
PID 3016 wrote to memory of 1172	3016	winver.exe	Dwm.exe
PID 3016 wrote to memory of 1196	3016	winver.exe	Explorer.EXE

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\37a5ef2f525e7568dc26ad76063e4bb3acc9b80ef12150dc4c765e06c95cfb6e_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-22-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1120-23-0x0000000077531000-0x0000000077532000-memory.dmp

Filesize
4KB

Download
memory/1172-19-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1172-24-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1196-25-0x0000000002A60000-0x0000000002A66000-memory.dmp

Filesize
24KB

Download
memory/1196-1-0x0000000002E30000-0x0000000002E36000-memory.dmp

Filesize
24KB

Download
memory/1196-3-0x0000000002E30000-0x0000000002E36000-memory.dmp

Filesize
24KB

Download
memory/1196-2-0x0000000002E30000-0x0000000002E36000-memory.dmp

Filesize
24KB

Download
memory/1196-9-0x0000000077531000-0x0000000077532000-memory.dmp

Filesize
4KB

Download
memory/1196-21-0x0000000002A60000-0x0000000002A66000-memory.dmp

Filesize
24KB

Download
memory/1792-4-0x0000000001C30000-0x0000000002630000-memory.dmp

Filesize
10.0MB

Download
memory/1792-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1792-12-0x0000000001C30000-0x0000000002630000-memory.dmp

Filesize
10.0MB

Download
memory/1792-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3016-5-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download
memory/3016-6-0x00000000776E0000-0x00000000776E1000-memory.dmp

Filesize
4KB

Download
memory/3016-10-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/3016-8-0x00000000776DF000-0x00000000776E1000-memory.dmp

Filesize
8KB

Download
memory/3016-7-0x00000000776DF000-0x00000000776E0000-memory.dmp

Filesize
4KB

Download
memory/3016-29-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/3016-30-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads