Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/06/2026, 00:24
General
- Target tmpl81sq9yc.exe
- Size 113KB
- Sample260602-aqdmmsbs3l
- SHA256 887be676bcab016af6bdba0297a92079fbcea918640f60fbae2bee6227b8979d
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpl81sq9yc.exe"C:\Users\Admin\AppData\Local\Temp\tmpl81sq9yc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 3524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\FB28A7F1\bin.exeC:\Users\Admin\AppData\Roaming\FB28A7F1\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3544 -ip 35441⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bin.exe
memory/2096-68-0x00007FFFF4C90000-0x00007FFFF4C91000-memory.dmp
memory/2096-32-0x0000000000460000-0x0000000000466000-memory.dmp
memory/3232-72-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-55-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-121-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-122-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-123-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-124-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-125-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-120-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-116-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-15-0x00007FFFF4C80000-0x00007FFFF4C81000-memory.dmp
memory/3232-117-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-118-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-119-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-115-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-12-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/3232-114-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-113-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-112-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-8-0x00007FFFF4CA0000-0x00007FFFF4CA1000-memory.dmp
memory/3232-33-0x00007FFFF4C90000-0x00007FFFF4C91000-memory.dmp
memory/3232-36-0x0000000008740000-0x0000000008750000-memory.dmp
memory/3232-35-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-41-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-44-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-45-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-43-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-47-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-54-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-83-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-61-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-62-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-111-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-60-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-59-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-58-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-57-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-56-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-53-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-82-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-51-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-50-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-49-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-48-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-46-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-42-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-40-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-71-0x00007FFFD7832000-0x00007FFFD7833000-memory.dmp
memory/3232-37-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-38-0x00007FFFD7832000-0x00007FFFD7833000-memory.dmp
memory/3232-34-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-66-0x0000000008740000-0x0000000008750000-memory.dmp
memory/3232-65-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-7-0x00007FFFF4B0D000-0x00007FFFF4B0E000-memory.dmp
memory/3232-5-0x0000000002AC0000-0x0000000002AC6000-memory.dmp
memory/3232-39-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-13-0x00007FFFF4C70000-0x00007FFFF4C71000-memory.dmp
memory/3232-52-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-81-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-86-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-90-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-91-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-89-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-88-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-95-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-94-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-93-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-92-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-87-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-85-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-84-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-80-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-79-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-78-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-77-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-76-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-75-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-74-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-73-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-70-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-69-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-97-0x00007FFFD7790000-0x00007FFFD7897000-memory.dmp
memory/3232-96-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-98-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-99-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-103-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-102-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-101-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-100-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-104-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-109-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-108-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-107-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-106-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-105-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3232-110-0x0000000008730000-0x0000000008740000-memory.dmp
memory/3292-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3292-1-0x0000000000407000-0x0000000000408000-memory.dmp
memory/3292-2-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3544-11-0x0000000000BE0000-0x0000000000BE6000-memory.dmp
memory/3544-3-0x0000000000BE0000-0x0000000000BE6000-memory.dmp
memory/3544-64-0x0000000000BE0000-0x0000000000BE6000-memory.dmp
memory/3544-6-0x0000000077CE2000-0x0000000077CE3000-memory.dmp
memory/3636-16-0x0000012DDBD40000-0x0000012DDBD46000-memory.dmp
memory/3636-23-0x00007FFFF4A70000-0x00007FFFF4C65000-memory.dmp
memory/3636-20-0x00007FFFF4A70000-0x00007FFFF4C65000-memory.dmp
memory/3636-29-0x00007FFFF4A70000-0x00007FFFF4C65000-memory.dmp
memory/5112-24-0x00007FFFF4A70000-0x00007FFFF4C65000-memory.dmp
memory/5112-22-0x0000000000400000-0x000000000041E000-memory.dmp
memory/5112-25-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/5112-27-0x0000000002230000-0x0000000002C30000-memory.dmp