Analysis

  • max time kernel
    118s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2024, 17:32 UTC

General

  • Target

    e0904f6e511df12e81ea3dab2807054ddaf35afb1c0c9f1065d555630c2addadN.exe

  • Size

    49KB

  • MD5

    bb3d84cfcff7667bd414aa8589daa970

  • SHA1

    d878230c5b2a57dcd1a92440597e8a9b052a925d

  • SHA256

    e0904f6e511df12e81ea3dab2807054ddaf35afb1c0c9f1065d555630c2addad

  • SHA512

    c29e155f18aeae261b1e33008648cafc7987f9dd596a6aa6466a41388223cf762100197444149cfbef9e62c7c8aeb79c2751f6a4ed17ad621cc3fa9aa1885aff

  • SSDEEP

    1536:wOBLXNqgzf2v6b6NkXklZlogHGe9eBXW:wYLduv6OqXIlogmjW

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2996
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\e0904f6e511df12e81ea3dab2807054ddaf35afb1c0c9f1065d555630c2addadN.exe
        "C:\Users\Admin\AppData\Local\Temp\e0904f6e511df12e81ea3dab2807054ddaf35afb1c0c9f1065d555630c2addadN.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 352
            4⤵
            • Program crash
            PID:2712
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2824 -ip 2824
      1⤵
        PID:4044

      Network

      • flag-us
        DNS
        217.106.137.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.106.137.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.210.23.2.in-addr.arpa
        IN PTR
        Response
        88.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-88deploystaticakamaitechnologiescom
      • flag-us
        DNS
        68.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        68.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        28.118.140.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.118.140.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        197.87.175.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        197.87.175.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        29.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        29.243.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        217.106.137.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        217.106.137.52.in-addr.arpa

      • 8.8.8.8:53
        88.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        88.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        68.32.126.40.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        68.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        28.118.140.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        28.118.140.52.in-addr.arpa

      • 8.8.8.8:53
        197.87.175.4.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        197.87.175.4.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        29.243.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        29.243.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2824-5-0x0000000077EA2000-0x0000000077EA3000-memory.dmp

        Filesize

        4KB

      • memory/2824-16-0x0000000000750000-0x0000000000756000-memory.dmp

        Filesize

        24KB

      • memory/2824-13-0x0000000000750000-0x0000000000756000-memory.dmp

        Filesize

        24KB

      • memory/2824-7-0x00007FFFC19F0000-0x00007FFFC1BE5000-memory.dmp

        Filesize

        2.0MB

      • memory/2996-15-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

        Filesize

        24KB

      • memory/3548-2-0x0000000000BF0000-0x0000000000BF6000-memory.dmp

        Filesize

        24KB

      • memory/3548-6-0x00007FFFC1A8D000-0x00007FFFC1A8E000-memory.dmp

        Filesize

        4KB

      • memory/3548-11-0x00007FFFC1C20000-0x00007FFFC1C21000-memory.dmp

        Filesize

        4KB

      • memory/3548-3-0x0000000000BF0000-0x0000000000BF6000-memory.dmp

        Filesize

        24KB

      • memory/3932-4-0x0000000002190000-0x0000000002B90000-memory.dmp

        Filesize

        10.0MB

      • memory/3932-9-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/3932-10-0x0000000002190000-0x0000000002B90000-memory.dmp

        Filesize

        10.0MB

      • memory/3932-0-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/3932-1-0x0000000002160000-0x0000000002161000-memory.dmp

        Filesize

        4KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.