Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/06/2026, 00:59
General
- Target tmpec3m0ebs.exe
- Size 45KB
- Sample260602-bcg9caas3y
- SHA256 dce4f7e52d3edd396d33e0c71b7743e3ff2e4631048d757bd3386e87d7f650cd
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpec3m0ebs.exe"C:\Users\Admin\AppData\Local\Temp\tmpec3m0ebs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 3524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 392 -ip 3921⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/392-6-0x0000000000CE0000-0x0000000000CE6000-memory.dmp
memory/392-7-0x0000000077B72000-0x0000000077B73000-memory.dmp
memory/392-23-0x0000000000CE0000-0x0000000000CE6000-memory.dmp
memory/1636-18-0x000001BE43690000-0x000001BE43696000-memory.dmp
memory/2332-85-0x00007FFC14D90000-0x00007FFC14D91000-memory.dmp
memory/2332-25-0x0000000000460000-0x0000000000466000-memory.dmp
memory/2332-22-0x0000000000460000-0x0000000000466000-memory.dmp
memory/3272-66-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-103-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-15-0x00007FFC14D70000-0x00007FFC14D71000-memory.dmp
memory/3272-14-0x0000000002740000-0x0000000002741000-memory.dmp
memory/3272-10-0x00007FFC14DA0000-0x00007FFC14DA1000-memory.dmp
memory/3272-24-0x00007FFC14D90000-0x00007FFC14D91000-memory.dmp
memory/3272-8-0x00000000027A0000-0x00000000027A6000-memory.dmp
memory/3272-28-0x0000000002830000-0x0000000002840000-memory.dmp
memory/3272-27-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-26-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-30-0x00007FFBF7112000-0x00007FFBF7113000-memory.dmp
memory/3272-29-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-31-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-36-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-37-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-35-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-38-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-69-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-33-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-32-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-39-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-40-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-41-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-46-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-47-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-45-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-44-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-43-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-42-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-49-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-48-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-50-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-51-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-53-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-52-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-55-0x0000000002830000-0x0000000002840000-memory.dmp
memory/3272-54-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-57-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-56-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-59-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-58-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-60-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-62-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-61-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-65-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-9-0x00007FFC14C0D000-0x00007FFC14C0E000-memory.dmp
memory/3272-63-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-68-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-16-0x00007FFC14D80000-0x00007FFC14D81000-memory.dmp
memory/3272-67-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-34-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-72-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-74-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-73-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-71-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-70-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-75-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-76-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-77-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-78-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-79-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-80-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-81-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-82-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-83-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-84-0x00007FFBF7070000-0x00007FFBF7177000-memory.dmp
memory/3272-4-0x00000000027A0000-0x00000000027A6000-memory.dmp
memory/3272-86-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-87-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-88-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-91-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-90-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-89-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-92-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-93-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-97-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-96-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-95-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-94-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-99-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-98-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-100-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-101-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-102-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-64-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-104-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-105-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-107-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-106-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-108-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-110-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-112-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-111-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-109-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3272-113-0x0000000002820000-0x0000000002830000-memory.dmp
memory/4472-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4472-1-0x000000000041C000-0x000000000041D000-memory.dmp
memory/4472-3-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4472-2-0x0000000000400000-0x000000000041D000-memory.dmp