Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 19:36 UTC

General

  • Target

    f215eff820c71d9a197aa89262ef08f0cf487b0249c957a84475faf7f9a6ef5dN.exe

  • Size

    89KB

  • MD5

    054cc9abc8d6a0a52d7f40dc33dd28d0

  • SHA1

    1c166ae84e99f6c5a6a4ce650d43e278012260f1

  • SHA256

    f215eff820c71d9a197aa89262ef08f0cf487b0249c957a84475faf7f9a6ef5d

  • SHA512

    33dfff3ce9a24d49416caffd187bae7f651c19dbd82f0f38bda6f6278fb1ee7538fa49654de1cf06e1a27ba5b5788aae4eb39468942099f5868722ac044ffe58

  • SSDEEP

    1536:h1+mFM2HXKZgixhIksu+XM5/HtAQ9Jox7e:r+4MJIkLZJNAQ9Jo9e

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2944
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of UnmapMainImage
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\f215eff820c71d9a197aa89262ef08f0cf487b0249c957a84475faf7f9a6ef5dN.exe
        "C:\Users\Admin\AppData\Local\Temp\f215eff820c71d9a197aa89262ef08f0cf487b0249c957a84475faf7f9a6ef5dN.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 352
            4⤵
            • Program crash
            PID:4684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3660 -ip 3660
      1⤵
        PID:5096

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        196.249.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.249.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        196.249.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.249.167.52.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        212.20.149.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        212.20.149.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        79.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        79.190.18.2.in-addr.arpa
        IN PTR
        Response
        79.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-79deploystaticakamaitechnologiescom
      No results found
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
        90 B
        1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        13.86.106.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        13.86.106.20.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        2.159.190.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        2.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        196.249.167.52.in-addr.arpa
        dns
        146 B
        147 B
        2
        1

        DNS Request

        196.249.167.52.in-addr.arpa

        DNS Request

        196.249.167.52.in-addr.arpa

      • 8.8.8.8:53
        212.20.149.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        212.20.149.52.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        370 B
        5

        DNS Request

        172.214.232.199.in-addr.arpa

        DNS Request

        172.214.232.199.in-addr.arpa

        DNS Request

        172.214.232.199.in-addr.arpa

        DNS Request

        172.214.232.199.in-addr.arpa

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        79.190.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        79.190.18.2.in-addr.arpa

      • 8.8.8.8:53

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/736-10-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/736-1-0x0000000000B50000-0x0000000000B51000-memory.dmp

        Filesize

        4KB

      • memory/736-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/736-4-0x00000000021B0000-0x0000000002BB0000-memory.dmp

        Filesize

        10.0MB

      • memory/736-11-0x00000000021B0000-0x0000000002BB0000-memory.dmp

        Filesize

        10.0MB

      • memory/2944-16-0x0000000000B10000-0x0000000000B16000-memory.dmp

        Filesize

        24KB

      • memory/3464-2-0x0000000000D60000-0x0000000000D66000-memory.dmp

        Filesize

        24KB

      • memory/3464-8-0x00007FFD54120000-0x00007FFD54121000-memory.dmp

        Filesize

        4KB

      • memory/3464-6-0x00007FFD53F8D000-0x00007FFD53F8E000-memory.dmp

        Filesize

        4KB

      • memory/3464-12-0x00007FFD54100000-0x00007FFD54101000-memory.dmp

        Filesize

        4KB

      • memory/3464-3-0x0000000000D60000-0x0000000000D66000-memory.dmp

        Filesize

        24KB

      • memory/3660-5-0x0000000076ED2000-0x0000000076ED3000-memory.dmp

        Filesize

        4KB

      • memory/3660-7-0x00007FFD53EF0000-0x00007FFD540E5000-memory.dmp

        Filesize

        2.0MB

      • memory/3660-14-0x0000000002A70000-0x0000000002A76000-memory.dmp

        Filesize

        24KB

      • memory/3660-17-0x0000000002A70000-0x0000000002A76000-memory.dmp

        Filesize

        24KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.