tinba | 1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc

General

Target

1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe
Size

45KB
MD5

e8cb2059a0e50a57419eb62f43612970
SHA1

519b649217f014e3b04d0cfb6eccd33cc4d1db2d
SHA256

1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc
SHA512

df73e529ddb053ac72d29539d6e840bc16d5b894a50e45374fd33a0d41188caccf9825569843a22c3bf1411939343ce90b399513db72d066bfa6924420db2813
SSDEEP

768:phP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:zsWE9N5dFu53dsniQaB/xZ14n7zIF+qr

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4872-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7F0F57AA = "C:\\Users\\Admin\\AppData\\Roaming\\7F0F57AA\\bin.exe"	winver.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1876 3516 WerFault.exe winver.exe
Modifies registry class 1 IoCs

Processes:

Explorer.EXE

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

3516 winver.exe
3516 winver.exe

pid	pid_target	process	target process
1876	3516	WerFault.exe	winver.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

pid	process
3516	winver.exe
3516	winver.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

winver.exeExplorer.EXE

pid process

3516 winver.exe
3520 Explorer.EXE
3520 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3520 Explorer.EXE

pid	process
3516	winver.exe
3520	Explorer.EXE
3520	Explorer.EXE

pid	process
3520	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exewinver.exe

description	pid	process	target process
PID 4872 wrote to memory of 3516	4872	1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe	winver.exe
PID 4872 wrote to memory of 3516	4872	1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe	winver.exe
PID 4872 wrote to memory of 3516	4872	1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe	winver.exe
PID 4872 wrote to memory of 3516	4872	1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe	winver.exe
PID 3516 wrote to memory of 3520	3516	winver.exe	Explorer.EXE
PID 3516 wrote to memory of 3056	3516	winver.exe	sihost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3056

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3520

C:\Users\Admin\AppData\Local\Temp\1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe
"C:\Users\Admin\AppData\Local\Temp\1c2586ca619841396d6e00fd34d4a6242920982ab37304856c3210acc964e7cc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 352
4⤵
- Program crash
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 3516
1⤵
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-20-0x00007FF9F68B0000-0x00007FF9F68B1000-memory.dmp

Filesize
4KB

Download
memory/3056-17-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/3516-5-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/3516-18-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

Filesize
24KB

Download
memory/3516-15-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

Filesize
24KB

Download
memory/3516-8-0x00007FF9F6690000-0x00007FF9F6885000-memory.dmp

Filesize
2.0MB

Download
memory/3520-13-0x00007FF9F68A0000-0x00007FF9F68A1000-memory.dmp

Filesize
4KB

Download
memory/3520-6-0x00007FF9F672D000-0x00007FF9F672E000-memory.dmp

Filesize
4KB

Download
memory/3520-7-0x00007FF9F672C000-0x00007FF9F672D000-memory.dmp

Filesize
4KB

Download
memory/3520-9-0x00007FF9F68C0000-0x00007FF9F68C1000-memory.dmp

Filesize
4KB

Download
memory/3520-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3520-3-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4872-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4872-12-0x00000000021F0000-0x0000000002BF0000-memory.dmp

Filesize
10.0MB

Download
memory/4872-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4872-4-0x00000000021F0000-0x0000000002BF0000-memory.dmp

Filesize
10.0MB

Download
memory/4872-1-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads