tinba | 28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6

General

Target

28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe
Size

225KB
MD5

461b1e06dfd698a997f972023877dbb0
SHA1

8f4c32d8b83ec3ef029af5930650f6ced7085e99
SHA256

28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6
SHA512

6a5c9eede775b8c35691a6a4531d96599c962ce1cd77fa8f4e05215132d47fefffb310baef57ae6eff45b5d9d7f8a6a96a45b194ae80310865d9493d2d3fb234
SSDEEP

6144:3A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:3ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\1CCCABCC = "C:\\Users\\Admin\\AppData\\Roaming\\1CCCABCC\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

pid	process
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe
2652	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2652 winver.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 2384 wrote to memory of 2652	2384	28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe	winver.exe
PID 2384 wrote to memory of 2652	2384	28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe	winver.exe
PID 2384 wrote to memory of 2652	2384	28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe	winver.exe
PID 2384 wrote to memory of 2652	2384	28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe	winver.exe
PID 2384 wrote to memory of 2652	2384	28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe	winver.exe
PID 2652 wrote to memory of 1204	2652	winver.exe	Explorer.EXE
PID 2652 wrote to memory of 1124	2652	winver.exe	taskhost.exe
PID 2652 wrote to memory of 1172	2652	winver.exe	Dwm.exe
PID 2652 wrote to memory of 1204	2652	winver.exe	Explorer.EXE
PID 2652 wrote to memory of 2384	2652	winver.exe	28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\28b28dbf36ccad6015644a605d7b37a4a440665cff8bd5eea1bb91f8e785eba6_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-23-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1124-9-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1172-12-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1172-24-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1204-25-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/1204-15-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/1204-1-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1204-6-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1204-3-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/2384-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2652-20-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2652-4-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/2652-27-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads