Analysis

  • max time kernel
    118s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 20:06 UTC

General

  • Target

    8671cdb5f474895ddc4b4e5616a8037ca2e03d5bfd0087e61e5b11dae01e7e8b.exe

  • Size

    113KB

  • MD5

    e4302d684967bb84560e69c19996ea97

  • SHA1

    c5d530027ca7cdd224dba46b7fc4d1b4a8a246c7

  • SHA256

    8671cdb5f474895ddc4b4e5616a8037ca2e03d5bfd0087e61e5b11dae01e7e8b

  • SHA512

    006254a6c4c1f145eb1d74bc10f62c161d466ce7218152c0a90203dcd8564ca0400c9365632e709807bcebe36e0630faafbeda5ead59bf04d180dacb619af828

  • SSDEEP

    1536:3iLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0Eh:3iyvRmDLs/ZrwWjjAqGcfzWHh

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3108
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3528
      • C:\Users\Admin\AppData\Local\Temp\8671cdb5f474895ddc4b4e5616a8037ca2e03d5bfd0087e61e5b11dae01e7e8b.exe
        "C:\Users\Admin\AppData\Local\Temp\8671cdb5f474895ddc4b4e5616a8037ca2e03d5bfd0087e61e5b11dae01e7e8b.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3968
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 356
            4⤵
            • Program crash
            PID:1108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3968 -ip 3968
      1⤵
        PID:4080

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        228.249.119.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.249.119.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.210.23.2.in-addr.arpa
        IN PTR
        Response
        88.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-88deploystaticakamaitechnologiescom
      • flag-us
        DNS
        64.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        200.163.202.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.163.202.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        180.129.81.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.129.81.91.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        23.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        23.236.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
        90 B
        1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        228.249.119.40.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        228.249.119.40.in-addr.arpa

      • 8.8.8.8:53
        88.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        88.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        64.159.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        64.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        200.163.202.172.in-addr.arpa
        dns
        74 B
        160 B
        1
        1

        DNS Request

        200.163.202.172.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        180.129.81.91.in-addr.arpa
        dns
        72 B
        147 B
        1
        1

        DNS Request

        180.129.81.91.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        23.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        23.236.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1312-10-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/1312-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

        Filesize

        4KB

      • memory/1312-0-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/1312-4-0x00000000022D0000-0x0000000002CD0000-memory.dmp

        Filesize

        10.0MB

      • memory/1312-11-0x00000000022D0000-0x0000000002CD0000-memory.dmp

        Filesize

        10.0MB

      • memory/3108-16-0x0000000000360000-0x0000000000366000-memory.dmp

        Filesize

        24KB

      • memory/3528-3-0x0000000000C00000-0x0000000000C06000-memory.dmp

        Filesize

        24KB

      • memory/3528-7-0x00007FFB43C6D000-0x00007FFB43C6E000-memory.dmp

        Filesize

        4KB

      • memory/3528-12-0x00007FFB43E00000-0x00007FFB43E01000-memory.dmp

        Filesize

        4KB

      • memory/3528-2-0x0000000000C00000-0x0000000000C06000-memory.dmp

        Filesize

        24KB

      • memory/3968-5-0x0000000000F60000-0x0000000000F66000-memory.dmp

        Filesize

        24KB

      • memory/3968-8-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3968-6-0x0000000077E12000-0x0000000077E13000-memory.dmp

        Filesize

        4KB

      • memory/3968-17-0x0000000000F60000-0x0000000000F66000-memory.dmp

        Filesize

        24KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.