Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/06/2026, 00:53
General
- Target tmpemz98upq.exe
- Size 45KB
- Sample260602-a8wwyah17t
- SHA256 d2a6d70ab0eaf14f90e230613dc0844b3e5d44102ade248a2589318082dde8ba
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpemz98upq.exe"C:\Users\Admin\AppData\Local\Temp\tmpemz98upq.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 3524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4272 -ip 42721⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1808-18-0x00007FF821EED000-0x00007FF821EEE000-memory.dmp
memory/1808-24-0x0000000000630000-0x0000000000636000-memory.dmp
memory/1808-23-0x00007FF822070000-0x00007FF822071000-memory.dmp
memory/1808-17-0x0000000000630000-0x0000000000636000-memory.dmp
memory/3264-60-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-33-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-14-0x00007FF822050000-0x00007FF822051000-memory.dmp
memory/3264-15-0x00007FF822060000-0x00007FF822061000-memory.dmp
memory/3264-106-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-12-0x0000000001560000-0x0000000001561000-memory.dmp
memory/3264-108-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-109-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-22-0x00007FF822070000-0x00007FF822071000-memory.dmp
memory/3264-8-0x00007FF822080000-0x00007FF822081000-memory.dmp
memory/3264-5-0x0000000002F00000-0x0000000002F06000-memory.dmp
memory/3264-25-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-27-0x00000000036F0000-0x0000000003700000-memory.dmp
memory/3264-26-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-29-0x00007FF8045F2000-0x00007FF8045F3000-memory.dmp
memory/3264-28-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-30-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-65-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-36-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-35-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-34-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-31-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-32-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-37-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-38-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-40-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-39-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-46-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-45-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-44-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-43-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-42-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-41-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-49-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-50-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-53-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-52-0x00000000036F0000-0x0000000003700000-memory.dmp
memory/3264-54-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-51-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-48-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-47-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-55-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-56-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-57-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-59-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-58-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-7-0x00007FF821EED000-0x00007FF821EEE000-memory.dmp
memory/3264-63-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-107-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-98-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-62-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-64-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-66-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-67-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-68-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-69-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-73-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-75-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-72-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-71-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-70-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-74-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-77-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-76-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-78-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-79-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-80-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-81-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-82-0x00007FF804550000-0x00007FF804657000-memory.dmp
memory/3264-83-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-84-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-85-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-86-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-87-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-88-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-89-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-90-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-93-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-94-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-91-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-92-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-95-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-96-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-97-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-61-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-99-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-100-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-101-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-102-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-103-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-104-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/3264-105-0x00000000036E0000-0x00000000036F0000-memory.dmp
memory/4272-3-0x00000000004A0000-0x00000000004A6000-memory.dmp
memory/4272-21-0x00000000004A0000-0x00000000004A6000-memory.dmp
memory/4272-11-0x00000000004A0000-0x00000000004A6000-memory.dmp
memory/4272-6-0x0000000077D72000-0x0000000077D73000-memory.dmp
memory/4964-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4964-1-0x000000000041C000-0x000000000041D000-memory.dmp
memory/4964-2-0x0000000000400000-0x000000000041D000-memory.dmp