Analysis
- max time kernel
148s - max time network
150s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
- submitted
02/07/2024, 01:28
General
- Target a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe
- Size 89KB
- Sample240702-bvvbma1fnd
- SHA256 a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe"C:\Users\Admin\AppData\Local\Temp\a2aa12090aaab3ae5ee1af85f6ff51723dace7f724c801aa45cd0fb969288a53.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/948-1-0x0000000002600000-0x0000000003000000-memory.dmp
memory/948-15-0x0000000000400000-0x000000000041D000-memory.dmp
memory/948-0-0x0000000000240000-0x0000000000242000-memory.dmp
memory/948-33-0x0000000002600000-0x0000000003000000-memory.dmp
memory/1120-17-0x0000000000490000-0x0000000000496000-memory.dmp
memory/1120-31-0x0000000000490000-0x0000000000496000-memory.dmp
memory/1180-27-0x0000000000230000-0x0000000000236000-memory.dmp
memory/1180-19-0x0000000000230000-0x0000000000236000-memory.dmp
memory/1180-28-0x00000000776F1000-0x00000000776F2000-memory.dmp
memory/1200-13-0x00000000776F1000-0x00000000776F2000-memory.dmp
memory/1200-3-0x0000000002CD0000-0x0000000002CD6000-memory.dmp
memory/1200-2-0x0000000002CD0000-0x0000000002CD6000-memory.dmp
memory/1200-32-0x0000000002CE0000-0x0000000002CE6000-memory.dmp
memory/1200-12-0x0000000002CD0000-0x0000000002CD6000-memory.dmp
memory/1200-22-0x0000000002CE0000-0x0000000002CE6000-memory.dmp
memory/1848-9-0x000000007789F000-0x00000000778A1000-memory.dmp
memory/1848-14-0x00000000776A0000-0x0000000077849000-memory.dmp
memory/1848-6-0x00000000000B0000-0x00000000000B6000-memory.dmp
memory/1848-7-0x00000000778A0000-0x00000000778A1000-memory.dmp
memory/1848-8-0x000000007789F000-0x00000000778A0000-memory.dmp
memory/1848-11-0x00000000003D1000-0x00000000003D2000-memory.dmp
memory/1848-10-0x0000000000130000-0x0000000000131000-memory.dmp
memory/1848-39-0x00000000000B0000-0x00000000000B6000-memory.dmp
memory/2028-24-0x00000000004E0000-0x00000000004E6000-memory.dmp
memory/2028-30-0x00000000776F1000-0x00000000776F2000-memory.dmp
memory/2028-29-0x00000000004E0000-0x00000000004E6000-memory.dmp