Analysis
- max time kernel
149s - max time network
157s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
22/05/2026, 12:17
General
- Target tmpozfiif5t.exe
- Size 34KB
- Sample260522-pf7kasds6v
- SHA256 b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpozfiif5t.exe"C:\Users\Admin\AppData\Local\Temp\tmpozfiif5t.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 3884⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\30B3CBAC\bin.exeC:\Users\Admin\AppData\Roaming\30B3CBAC\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2192 -ip 21921⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bin.exe
memory/2192-7-0x00007FFFDAE30000-0x00007FFFDB028000-memory.dmp
memory/2192-5-0x0000000077323000-0x0000000077324000-memory.dmp
memory/2192-11-0x00000000005F0000-0x00000000005F6000-memory.dmp
memory/2192-33-0x00000000005F0000-0x00000000005F6000-memory.dmp
memory/2300-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2300-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2300-9-0x00000000022A0000-0x0000000002CA0000-memory.dmp
memory/2300-4-0x00000000022A0000-0x0000000002CA0000-memory.dmp
memory/2300-1-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2384-29-0x0000000002410000-0x0000000002E10000-memory.dmp
memory/2384-25-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/2384-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2384-24-0x00007FFFDAE30000-0x00007FFFDB028000-memory.dmp
memory/3184-28-0x0000000000510000-0x0000000000516000-memory.dmp
memory/3496-64-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-84-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-120-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-14-0x00007FFFDB030000-0x00007FFFDB031000-memory.dmp
memory/3496-119-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-15-0x00007FFFDB040000-0x00007FFFDB041000-memory.dmp
memory/3496-12-0x0000000002970000-0x0000000002971000-memory.dmp
memory/3496-6-0x00007FFFDAECD000-0x00007FFFDAECE000-memory.dmp
memory/3496-118-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-2-0x00000000029B0000-0x00000000029B6000-memory.dmp
memory/3496-35-0x00007FFFDB050000-0x00007FFFDB051000-memory.dmp
memory/3496-36-0x00007FFFDB060000-0x00007FFFDB061000-memory.dmp
memory/3496-37-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-39-0x0000000000FC0000-0x0000000000FD0000-memory.dmp
memory/3496-38-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-41-0x00007FFFBDD72000-0x00007FFFBDD73000-memory.dmp
memory/3496-40-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-42-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-44-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-43-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-46-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-45-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-54-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-53-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-52-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-51-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-50-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-49-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-48-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-47-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-59-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-60-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-58-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-57-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-56-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-55-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-66-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-67-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-65-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-3-0x00000000029B0000-0x00000000029B6000-memory.dmp
memory/3496-63-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-62-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-61-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-69-0x0000000000FC0000-0x0000000000FD0000-memory.dmp
memory/3496-68-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-76-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-80-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-115-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-90-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-93-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-94-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-92-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-91-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-89-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-88-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-87-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-86-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-85-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-83-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-82-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-81-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-79-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-78-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-77-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-75-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-74-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-73-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-72-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-71-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-70-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-95-0x00007FFFBDCD0000-0x00007FFFBDDD7000-memory.dmp
memory/3496-99-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-101-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-100-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-102-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-107-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-108-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-111-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-110-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-109-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-106-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-105-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-104-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-103-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-98-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-97-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-96-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-112-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-113-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-114-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-117-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/3496-116-0x0000000000FB0000-0x0000000000FC0000-memory.dmp
memory/4032-16-0x00007FFFDAE30000-0x00007FFFDB028000-memory.dmp
memory/4032-31-0x00007FFFDAE30000-0x00007FFFDB028000-memory.dmp
memory/4032-20-0x00007FFFDAE30000-0x00007FFFDB028000-memory.dmp
memory/4032-23-0x00007FFFDAE30000-0x00007FFFDB028000-memory.dmp