tinba | 989fc2fa2a1a57672bbc9d8ed02463000769c9e69508e4c0f9c8bedbbe53d565

General

Target

2015-07-27 10.34.06 voice.wav.exe
Size

100KB
MD5

8af1ac4476bd48388fd690c6bdf82eb8
SHA1

9541efff429a869992c046a81d4a04842835e1ce
SHA256

d445d97c79e6578a194e85619ab0183d930ac4041b73210582f04b4a6d6300ad
SHA512

dd735d40f46236d0d5805347f107c3f276b60154735537faf9f82f20a9f2d2d6d28db08e0894ed3a810c484d9d18fedaa55da050de5af9c577deb63d3d020e1e
SSDEEP

1536:YryIOzqdHP1HDYObBAG88zff0B/xDy9Qq/dU1+K975AnpUH/rT6Ic:QzdHF3lacn0BJoQGUQKDgp0/36z

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba
Tinba family
tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8BE4A42A = "C:\\Users\\Admin\\AppData\\Roaming\\8BE4A42A\\bin.exe"	EXPLORER.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8	4804	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2015-07-27 10.34.06 voice.wav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2015-07-27 10.34.06 voice.wav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPLORER.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1320	2015-07-27 10.34.06 voice.wav.exe
1320	2015-07-27 10.34.06 voice.wav.exe
4804	EXPLORER.exe
4804	EXPLORER.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	2015-07-27 10.34.06 voice.wav.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 1320 wrote to memory of 4668	1320	2015-07-27 10.34.06 voice.wav.exe	83
PID 4668 wrote to memory of 4804	4668	2015-07-27 10.34.06 voice.wav.exe	84
PID 4668 wrote to memory of 4804	4668	2015-07-27 10.34.06 voice.wav.exe	84
PID 4668 wrote to memory of 4804	4668	2015-07-27 10.34.06 voice.wav.exe	84
PID 4668 wrote to memory of 4804	4668	2015-07-27 10.34.06 voice.wav.exe	84
PID 4804 wrote to memory of 2868	4804	EXPLORER.exe	50

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2868

C:\Users\Admin\AppData\Local\Temp\2015-07-27 10.34.06 voice.wav.exe
"C:\Users\Admin\AppData\Local\Temp\2015-07-27 10.34.06 voice.wav.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\2015-07-27 10.34.06 voice.wav.exe
  "C:\Users\Admin\AppData\Local\Temp\2015-07-27 10.34.06 voice.wav.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\EXPLORER.exe
    EXPLORER
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 804
      4⤵
      Program crash
      PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4804 -ip 4804
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-0-0x0000000000AE0000-0x0000000000AE4000-memory.dmp

Filesize
16KB

Download
memory/2868-11-0x00000000007F0000-0x00000000007F7000-memory.dmp

Filesize
28KB

Download
memory/2868-12-0x00000000007F0000-0x00000000007F7000-memory.dmp

Filesize
28KB

Download
memory/2868-14-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

Filesize
4KB

Download
memory/2868-13-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

Filesize
4KB

Download
memory/2868-16-0x00000000007F0000-0x00000000007F7000-memory.dmp

Filesize
28KB

Download
memory/4668-1-0x0000000000400000-0x0000000001517000-memory.dmp

Filesize
17.1MB

Download
memory/4668-2-0x0000000000400000-0x0000000000404600-memory.dmp

Filesize
17KB

Download
memory/4804-3-0x00000000008E3000-0x00000000008E4000-memory.dmp

Filesize
4KB

Download
memory/4804-4-0x0000000000800000-0x0000000000C33000-memory.dmp

Filesize
4.2MB

Download
memory/4804-8-0x0000000001380000-0x0000000001387000-memory.dmp

Filesize
28KB

Download
memory/4804-15-0x0000000001380000-0x0000000001387000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads