tinba | 33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 20:14

Target

33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe
Size

225KB
MD5

b2c6f03c734ed4dcbb71f43d965adc55
SHA1

9b25ccf19fd7b2734e49ee77f71b80b62c1732d6
SHA256

33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3
SHA512

9cb1d6148dbd05448f1f11c65151850eee89638182ea87816302f6259f5dd076ac9eeaecc260724ad1aa22bddaa9c6e9889237d3e2d888dfd0a77cca1037d8c0
SSDEEP

6144:TA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:TATuTAnKGwUAW3ycQqgf

Score

10^/10

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\7BA79F73 = "C:\\Users\\Admin\\AppData\\Roaming\\7BA79F73\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2604 winver.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exewinver.exe

description	pid	process	target process
PID 1616 wrote to memory of 2604	1616	33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe	winver.exe
PID 1616 wrote to memory of 2604	1616	33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe	winver.exe
PID 1616 wrote to memory of 2604	1616	33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe	winver.exe
PID 1616 wrote to memory of 2604	1616	33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe	winver.exe
PID 1616 wrote to memory of 2604	1616	33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe	winver.exe
PID 2604 wrote to memory of 1192	2604	winver.exe	Explorer.EXE
PID 2604 wrote to memory of 1068	2604	winver.exe	taskhost.exe
PID 2604 wrote to memory of 1168	2604	winver.exe	Dwm.exe
PID 2604 wrote to memory of 1192	2604	winver.exe	Explorer.EXE
PID 2604 wrote to memory of 1616	2604	winver.exe	33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe

C:\Users\Admin\AppData\Local\Temp\33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe
"C:\Users\Admin\AppData\Local\Temp\33847e5ceedb328546b75e2226dc6149b8fc2ff3e1eec534a19556813ebaaee3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1616

memory/1068-23-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1068-9-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1168-12-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1168-24-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1192-1-0x0000000002D40000-0x0000000002D46000-memory.dmp

Filesize
24KB

Download
memory/1192-15-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/1192-6-0x0000000002D40000-0x0000000002D46000-memory.dmp

Filesize
24KB

Download
memory/1192-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/1192-3-0x0000000002D40000-0x0000000002D46000-memory.dmp

Filesize
24KB

Download
memory/1616-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2604-20-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2604-4-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2604-27-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download