Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 11:40
General
- Target tmp40hvmvte.exe
- Size 89KB
- Sample260522-ns6m4act8x
- SHA256 d812b7b575181b189d17a038870222bdf3ef2b4706d3087487a5454783165f73
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp40hvmvte.exe"C:\Users\Admin\AppData\Local\Temp\tmp40hvmvte.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 3804⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\CC70DAA7\bin.exeC:\Users\Admin\AppData\Roaming\CC70DAA7\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 540 -ip 5401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bin.exe
memory/540-5-0x0000000077844000-0x0000000077845000-memory.dmp
memory/540-7-0x00007FFB22300000-0x00007FFB22509000-memory.dmp
memory/540-11-0x00000000021E0000-0x00000000021E6000-memory.dmp
memory/540-32-0x00000000021E0000-0x00000000021E6000-memory.dmp
memory/672-0-0x0000000000400000-0x0000000000418000-memory.dmp
memory/672-8-0x0000000000400000-0x0000000000418000-memory.dmp
memory/672-9-0x0000000002210000-0x0000000002C10000-memory.dmp
memory/672-4-0x0000000002210000-0x0000000002C10000-memory.dmp
memory/672-1-0x0000000000570000-0x0000000000571000-memory.dmp
memory/1160-27-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/1160-24-0x00007FFB22300000-0x00007FFB22509000-memory.dmp
memory/1160-22-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2808-26-0x0000000000430000-0x0000000000436000-memory.dmp
memory/3216-35-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-46-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-59-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-14-0x00007FFB22510000-0x00007FFB22511000-memory.dmp
memory/3216-61-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-15-0x00007FFB22520000-0x00007FFB22521000-memory.dmp
memory/3216-12-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/3216-6-0x00007FFB223A3000-0x00007FFB223A4000-memory.dmp
memory/3216-62-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-3-0x0000000000C40000-0x0000000000C46000-memory.dmp
memory/3216-34-0x00007FFB22540000-0x00007FFB22541000-memory.dmp
memory/3216-33-0x00007FFB22530000-0x00007FFB22531000-memory.dmp
memory/3216-2-0x0000000000C40000-0x0000000000C46000-memory.dmp
memory/3216-36-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-37-0x0000000003040000-0x0000000003050000-memory.dmp
memory/3216-38-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-39-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-40-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-42-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-43-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-47-0x0000000003060000-0x0000000003070000-memory.dmp
memory/3216-63-0x0000000003040000-0x0000000003050000-memory.dmp
memory/3216-45-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-41-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-44-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-48-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-49-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-50-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-55-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-56-0x0000000003060000-0x0000000003070000-memory.dmp
memory/3216-54-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-53-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-52-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-51-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-57-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-58-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3216-60-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3472-17-0x00007FFB223A3000-0x00007FFB223A4000-memory.dmp
memory/3472-30-0x00007FFB22300000-0x00007FFB22509000-memory.dmp
memory/3472-20-0x00007FFB22300000-0x00007FFB22509000-memory.dmp
memory/3472-16-0x00000126EBB00000-0x00000126EBB06000-memory.dmp