tinba | 31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 23:33

Target

31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe
Size

225KB
MD5

95e2d392ac405b9a53dbbd9cd5e383e0
SHA1

c200a1e7153582e126ffca12daf9a6b42667858a
SHA256

31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e
SHA512

a3525798f938e786a0fa837a2e8252a4007d995a0c8346870c312c4adca23fe07d8a919f1f8bb7d8dbafe06d7bc93f8bd193df582ab8d96a3d4099697c1e30b5
SSDEEP

6144:7A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:7ATuTAnKGwUAW3ycQqgf

Score

10^/10

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\55201E47 = "C:\\Users\\Admin\\AppData\\Roaming\\55201E47\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

winver.exeExplorer.EXE

pid process

2664 winver.exe
1188 Explorer.EXE
1188 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE
1188 Explorer.EXE

pid	process
1188	Explorer.EXE
1188	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 1912 wrote to memory of 2664	1912	31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe	winver.exe
PID 1912 wrote to memory of 2664	1912	31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe	winver.exe
PID 1912 wrote to memory of 2664	1912	31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe	winver.exe
PID 1912 wrote to memory of 2664	1912	31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe	winver.exe
PID 1912 wrote to memory of 2664	1912	31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe	winver.exe
PID 2664 wrote to memory of 1188	2664	winver.exe	Explorer.EXE
PID 2664 wrote to memory of 1060	2664	winver.exe	taskhost.exe
PID 2664 wrote to memory of 1164	2664	winver.exe	Dwm.exe
PID 2664 wrote to memory of 1188	2664	winver.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\31ccb9082da9c7180b3605c8dcd6f094abb4c9934f6dfdac68a6d9a56ba0913e_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1912

memory/1060-23-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1060-11-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1164-14-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1164-21-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1188-1-0x0000000002F90000-0x0000000002F96000-memory.dmp

Filesize
24KB

Download
memory/1188-17-0x0000000003D30000-0x0000000003D36000-memory.dmp

Filesize
24KB

Download
memory/1188-3-0x0000000002F90000-0x0000000002F96000-memory.dmp

Filesize
24KB

Download
memory/1188-6-0x0000000002F90000-0x0000000002F96000-memory.dmp

Filesize
24KB

Download
memory/1188-22-0x0000000003D30000-0x0000000003D36000-memory.dmp

Filesize
24KB

Download
memory/1912-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2664-20-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2664-4-0x00000000000B0000-0x00000000000B6000-memory.dmp

Filesize
24KB

Download
memory/2664-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download