Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 12:18
General
- Target tmpnygu4mno.exe
- Size 45KB
- Sample260522-pg1hdads9t
- SHA256 c109ab2e088da970fb3765903a206e86e518db06cc545e3ced8381e784757078
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpnygu4mno.exe"C:\Users\Admin\AppData\Local\Temp\tmpnygu4mno.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 3564⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\88785B04\bin.exeC:\Users\Admin\AppData\Roaming\88785B04\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1436 -ip 14361⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bin.exe
memory/552-28-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/552-22-0x0000000000400000-0x000000000041D000-memory.dmp
memory/552-25-0x00007FFAC3790000-0x00007FFAC3985000-memory.dmp
memory/1436-5-0x00000000009D0000-0x00000000009D6000-memory.dmp
memory/1436-6-0x0000000077EC2000-0x0000000077EC3000-memory.dmp
memory/1436-35-0x00000000009D0000-0x00000000009D6000-memory.dmp
memory/2264-37-0x00007FFAC39B0000-0x00007FFAC39B1000-memory.dmp
memory/2264-27-0x0000000000F50000-0x0000000000F56000-memory.dmp
memory/3304-71-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-49-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-117-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-17-0x00007FFAC39A0000-0x00007FFAC39A1000-memory.dmp
memory/3304-14-0x0000000001240000-0x0000000001241000-memory.dmp
memory/3304-118-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-10-0x00007FFAC39C0000-0x00007FFAC39C1000-memory.dmp
memory/3304-4-0x0000000003310000-0x0000000003316000-memory.dmp
memory/3304-119-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-33-0x00007FFAC39B0000-0x00007FFAC39B1000-memory.dmp
memory/3304-7-0x0000000003310000-0x0000000003316000-memory.dmp
memory/3304-8-0x0000000003310000-0x0000000003316000-memory.dmp
memory/3304-38-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-39-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-40-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3304-42-0x00007FFAA5752000-0x00007FFAA5753000-memory.dmp
memory/3304-41-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-44-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-45-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-78-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-48-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-47-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-46-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-43-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-50-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-52-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-51-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-53-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-59-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-58-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-57-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-56-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-55-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-54-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-61-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-60-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-73-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-62-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-67-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-66-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-65-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-64-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-69-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3304-68-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-70-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-9-0x00007FFAC382D000-0x00007FFAC382E000-memory.dmp
memory/3304-72-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-74-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-63-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-16-0x00007FFAC3990000-0x00007FFAC3991000-memory.dmp
memory/3304-120-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-77-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-76-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-75-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-80-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-81-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-88-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-87-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-86-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-85-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-84-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-83-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-82-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-89-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-90-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-91-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-92-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-93-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-94-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-95-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-98-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-97-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-96-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-99-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-100-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-102-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-104-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-103-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-101-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-106-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-105-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-107-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-108-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-109-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3304-110-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-111-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-112-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-113-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-114-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-115-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-116-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-121-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3304-79-0x00007FFAA56B0000-0x00007FFAA57B7000-memory.dmp
memory/3592-31-0x00007FFAC3790000-0x00007FFAC3985000-memory.dmp
memory/3592-21-0x00007FFAC3790000-0x00007FFAC3985000-memory.dmp
memory/3592-23-0x00007FFAC3790000-0x00007FFAC3985000-memory.dmp
memory/4132-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4132-1-0x000000000041C000-0x000000000041D000-memory.dmp
memory/4132-3-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4132-2-0x0000000000400000-0x000000000041D000-memory.dmp