Analysis
- max time kernel
94s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/06/2026, 01:19
General
- Target tmpfufnrrn7.exe
- Size 89KB
- Sample260602-bphqmsav2y
- SHA256 454146b9e6283876a792643894a2b1c38e0fead807ce6602bf394478ce3ceca3
Malware Config
Signatures
- Family: Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpfufnrrn7.exe"C:\Users\Admin\AppData\Local\Temp\tmpfufnrrn7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 3524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Roaming\254BAF14\bin.exeC:\Users\Admin\AppData\Roaming\254BAF14\bin.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5232 -ip 52321⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bin.exe
memory/2280-28-0x00007FF9982F0000-0x00007FF9982F1000-memory.dmp
memory/2280-27-0x00000000002A0000-0x00000000002A6000-memory.dmp
memory/2344-20-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/2344-30-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/2344-18-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/3064-25-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/3064-21-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3064-23-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/3224-0-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3224-9-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3224-4-0x00000000020F0000-0x0000000002AF0000-memory.dmp
memory/3224-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/3344-61-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-75-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-108-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-14-0x00007FF9982D0000-0x00007FF9982D1000-memory.dmp
memory/3344-12-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3344-8-0x00007FF998300000-0x00007FF998301000-memory.dmp
memory/3344-6-0x00007FF99816D000-0x00007FF99816E000-memory.dmp
memory/3344-2-0x0000000002780000-0x0000000002786000-memory.dmp
memory/3344-109-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-111-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-110-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-33-0x00007FF9982F0000-0x00007FF9982F1000-memory.dmp
memory/3344-35-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-37-0x0000000007180000-0x0000000007190000-memory.dmp
memory/3344-36-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-38-0x00007FF979ED2000-0x00007FF979ED3000-memory.dmp
memory/3344-39-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-40-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-41-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-45-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-44-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-43-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-42-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-46-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-50-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-49-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-48-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-47-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-55-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-54-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-56-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-53-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-52-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-51-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-58-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-60-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-59-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-57-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-62-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-3-0x0000000002780000-0x0000000002786000-memory.dmp
memory/3344-63-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-64-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-65-0x0000000007180000-0x0000000007190000-memory.dmp
memory/3344-66-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-68-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-67-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-71-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-15-0x00007FF9982E0000-0x00007FF9982E1000-memory.dmp
memory/3344-74-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-73-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-72-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-70-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-69-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-76-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-77-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-78-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-79-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-83-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-84-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-85-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-82-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-81-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-80-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-86-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-87-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-88-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-89-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-90-0x00007FF979E30000-0x00007FF979F37000-memory.dmp
memory/3344-96-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-97-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-102-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-106-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-105-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-104-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-103-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-101-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-98-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-100-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-99-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-94-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-95-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-93-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-92-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-91-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-107-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-112-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-113-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-115-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/3344-114-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/5232-32-0x0000000001150000-0x0000000001156000-memory.dmp
memory/5232-11-0x0000000001150000-0x0000000001156000-memory.dmp
memory/5232-7-0x00007FF9980D0000-0x00007FF9982C5000-memory.dmp
memory/5232-5-0x0000000077E22000-0x0000000077E23000-memory.dmp