Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 11:33
General
- Target tmpvfzkno_8.exe
- Size 110KB
- Sample260522-nn4ypsct4w
- SHA256 a830a127eeda6219bc80998b0497483e0126fb378b3f193ec17433819841186a
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpvfzkno_8.exe"C:\Users\Admin\AppData\Local\Temp\tmpvfzkno_8.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 3524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\390B6F94\bin.exeC:\Users\Admin\AppData\Roaming\390B6F94\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5640 -ip 56401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bin.exe
memory/2196-20-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2196-23-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/2196-22-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/2280-30-0x00007FF9982F0000-0x00007FF9982F1000-memory.dmp
memory/2280-26-0x00000000002A0000-0x00000000002A6000-memory.dmp
memory/3344-40-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-35-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-115-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-15-0x00007FF9982E0000-0x00007FF9982E1000-memory.dmp
memory/3344-114-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-116-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-113-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-14-0x00007FF9982D0000-0x00007FF9982D1000-memory.dmp
memory/3344-12-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3344-8-0x00007FF998300000-0x00007FF998301000-memory.dmp
memory/3344-112-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-4-0x0000000002780000-0x0000000002786000-memory.dmp
memory/3344-109-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-110-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-111-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-32-0x00007FF9982F0000-0x00007FF9982F1000-memory.dmp
memory/3344-36-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-68-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-34-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-37-0x00007FF97A132000-0x00007FF97A133000-memory.dmp
memory/3344-38-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-39-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-42-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-45-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-48-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-49-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-47-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-46-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-44-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-54-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-58-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-61-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-64-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-63-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-62-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-60-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-59-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-57-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-56-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-55-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-53-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-52-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-51-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-50-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-43-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-41-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-6-0x00007FF99816D000-0x00007FF99816E000-memory.dmp
memory/3344-67-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-108-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-102-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-66-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-69-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-71-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-70-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-74-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-73-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-72-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-75-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-77-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-76-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-78-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-79-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-84-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-83-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-82-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-81-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-80-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-85-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-86-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-87-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-88-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-89-0x00007FF97A090000-0x00007FF97A197000-memory.dmp
memory/3344-90-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-91-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-92-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-94-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-93-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-95-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-96-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-97-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-99-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-101-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-100-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-98-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-65-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-103-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-104-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-105-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-106-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/3344-107-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/4672-28-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/4672-21-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/4988-2-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4988-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4988-1-0x0000000000407000-0x0000000000408000-memory.dmp
memory/5640-31-0x0000000000780000-0x0000000000786000-memory.dmp
memory/5640-11-0x0000000000780000-0x0000000000786000-memory.dmp
memory/5640-7-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/5640-5-0x0000000000780000-0x0000000000786000-memory.dmp