tinba | 5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
Size

68KB
MD5

73469a200a7549c95a33040c575604cb
SHA1

b40ad74fba4718e47237108e60667188bd4437c9
SHA256

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617
SHA512

890b6c7f75c2e6b4caa3c5f26874027fef33d5f48cabc168ef94a4dbc6632c0806beeb9eeb088abbbb73431f264ebc1da10d1d4159eebebcdf7c6c5d294e4e7f
SSDEEP

768:NwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:N47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\2BBCA995 = "C:\\Users\\Admin\\AppData\\Roaming\\2BBCA995\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe
1796	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

1796 winver.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe

pid process

2888 5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe

pid	process
2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exewinver.exe

description	pid	process	target process
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2888 wrote to memory of 2952	2888	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
PID 2952 wrote to memory of 1796	2952	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 2952 wrote to memory of 1796	2952	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 2952 wrote to memory of 1796	2952	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 2952 wrote to memory of 1796	2952	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 2952 wrote to memory of 1796	2952	5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe	winver.exe
PID 1796 wrote to memory of 1204	1796	winver.exe	Explorer.EXE
PID 1796 wrote to memory of 1104	1796	winver.exe	taskhost.exe
PID 1796 wrote to memory of 1172	1796	winver.exe	Dwm.exe
PID 1796 wrote to memory of 1204	1796	winver.exe	Explorer.EXE
PID 1796 wrote to memory of 2164	1796	winver.exe	DllHost.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
"C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe
"C:\Users\Admin\AppData\Local\Temp\5878cc2f5d614a315e801f454c93f6b8fbd84efdf6ff6c3a3100d36aae56f617.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\winver.exe
winver
4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-18-0x0000000000210000-0x0000000000217000-memory.dmp

Filesize
28KB

Download
memory/1104-28-0x0000000000210000-0x0000000000217000-memory.dmp

Filesize
28KB

Download
memory/1104-29-0x0000000077361000-0x0000000077362000-memory.dmp

Filesize
4KB

Download
memory/1172-30-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download
memory/1172-20-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download
memory/1204-6-0x0000000002D30000-0x0000000002D37000-memory.dmp

Filesize
28KB

Download
memory/1204-23-0x0000000002D40000-0x0000000002D47000-memory.dmp

Filesize
28KB

Download
memory/1204-31-0x0000000002D40000-0x0000000002D47000-memory.dmp

Filesize
28KB

Download
memory/1204-7-0x0000000002D30000-0x0000000002D37000-memory.dmp

Filesize
28KB

Download
memory/1204-10-0x0000000002D30000-0x0000000002D37000-memory.dmp

Filesize
28KB

Download
memory/1204-13-0x0000000077361000-0x0000000077362000-memory.dmp

Filesize
4KB

Download
memory/1796-12-0x0000000000EA0000-0x0000000000EB6000-memory.dmp

Filesize
88KB

Download
memory/1796-14-0x0000000077310000-0x00000000774B9000-memory.dmp

Filesize
1.7MB

Download
memory/1796-11-0x0000000000EA1000-0x0000000000EA2000-memory.dmp

Filesize
4KB

Download
memory/1796-8-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/2164-25-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/2164-26-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/2164-27-0x0000000077361000-0x0000000077362000-memory.dmp

Filesize
4KB

Download
memory/2888-2-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2888-3-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2952-5-0x0000000000400000-0x0000000000404A00-memory.dmp

Filesize
18KB

Download
memory/2952-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download