Analysis

  • max time kernel
    104s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 01:35 UTC

General

  • Target

    5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe

  • Size

    89KB

  • MD5

    308d30e8b0b45c198ec2107d97eedeff

  • SHA1

    dc394a59b50ac780cfed32415bc0da2dc77fae12

  • SHA256

    5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4

  • SHA512

    f0c7bdb7a6b392da4c4d02ff845ad4606019087aabe372136bf6159922db47fe702e7784548b9f478e2a5087278cc842a212abfda8e50aac55d69a7de4131a69

  • SSDEEP

    1536:hr+mFM2HXKZgixhIksu+XM5/HtAQ9Jox76:l+4MJIkLZJNAQ9Jo96

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2672
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3460
      • C:\Users\Admin\AppData\Local\Temp\5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe
        "C:\Users\Admin\AppData\Local\Temp\5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 352
            4⤵
            • Program crash
            PID:4812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1424 -ip 1424
      1⤵
        PID:4256

      Network

      • flag-us
        DNS
        217.106.137.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.106.137.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        138.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        138.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        92.12.20.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        92.12.20.2.in-addr.arpa
        IN PTR
        Response
        92.12.20.2.in-addr.arpa
        IN PTR
        a2-20-12-92deploystaticakamaitechnologiescom
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        13.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.227.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        217.106.137.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        217.106.137.52.in-addr.arpa

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        138.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        138.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
        156 B
        1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        92.12.20.2.in-addr.arpa
        dns
        69 B
        131 B
        1
        1

        DNS Request

        92.12.20.2.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        13.227.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        13.227.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/824-1-0x00000000009C0000-0x00000000009C1000-memory.dmp

        Filesize

        4KB

      • memory/824-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/824-4-0x00000000021C0000-0x0000000002BC0000-memory.dmp

        Filesize

        10.0MB

      • memory/824-10-0x00000000021C0000-0x0000000002BC0000-memory.dmp

        Filesize

        10.0MB

      • memory/824-9-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/1424-12-0x00000000011A0000-0x00000000011A6000-memory.dmp

        Filesize

        24KB

      • memory/1424-15-0x00000000011A0000-0x00000000011A6000-memory.dmp

        Filesize

        24KB

      • memory/1424-5-0x00000000778D2000-0x00000000778D3000-memory.dmp

        Filesize

        4KB

      • memory/1424-7-0x00007FF83CE70000-0x00007FF83D065000-memory.dmp

        Filesize

        2.0MB

      • memory/2672-14-0x0000000000E80000-0x0000000000E86000-memory.dmp

        Filesize

        24KB

      • memory/3460-2-0x0000000000C00000-0x0000000000C06000-memory.dmp

        Filesize

        24KB

      • memory/3460-6-0x00007FF83CF0D000-0x00007FF83CF0E000-memory.dmp

        Filesize

        4KB

      • memory/3460-3-0x0000000000C00000-0x0000000000C06000-memory.dmp

        Filesize

        24KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.