tinba | 94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f

General

Target

94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe
Size

225KB
MD5

639602cab8f2176b4467eb4ec3834950
SHA1

1586528327684fef0e9290474d61e162435d781a
SHA256

94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f
SHA512

eb3413afc5c6601e622e90e45eb5da84c3c9778fe8f0d7632fcb10d62ad06b8ed00e2dcfd70ed6df31a3b74df2bb8aa8c70c186c70e177ff926b2094a259d6b0
SSDEEP

6144:nA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:nATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\6BC2CA44 = "C:\\Users\\Admin\\AppData\\Roaming\\6BC2CA44\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

pid	process
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe
2780	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2780 winver.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exewinver.exe

description	pid	process	target process
PID 2164 wrote to memory of 2780	2164	94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe	winver.exe
PID 2164 wrote to memory of 2780	2164	94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe	winver.exe
PID 2164 wrote to memory of 2780	2164	94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe	winver.exe
PID 2164 wrote to memory of 2780	2164	94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe	winver.exe
PID 2164 wrote to memory of 2780	2164	94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe	winver.exe
PID 2780 wrote to memory of 1336	2780	winver.exe	Explorer.EXE
PID 2780 wrote to memory of 1220	2780	winver.exe	taskhost.exe
PID 2780 wrote to memory of 1288	2780	winver.exe	Dwm.exe
PID 2780 wrote to memory of 1336	2780	winver.exe	Explorer.EXE
PID 2780 wrote to memory of 2164	2780	winver.exe	94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1220

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1288

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe
"C:\Users\Admin\AppData\Local\Temp\94c81420672fed3a2386621a79b660a72b0ccb72de6a8301beeb5e8260a1db0f.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2780

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1220-23-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1288-25-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1288-12-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1336-1-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1336-15-0x00000000025D0000-0x00000000025D6000-memory.dmp

Filesize
24KB

Download
memory/1336-3-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1336-6-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1336-24-0x00000000025D0000-0x00000000025D6000-memory.dmp

Filesize
24KB

Download
memory/2164-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2780-20-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2780-4-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2780-27-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads