tinba | 5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 21:43

Target

5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe
Size

225KB
MD5

8294eb4780b7d5168b8c161a50e30c9f
SHA1

d443a777d9bc0d76a46c0e95fb0d9ae1ad06e75f
SHA256

5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc
SHA512

39879f0b7d05a30f09ddffe9ad6483505a4b413cad6713bfc76577505238426e452a379d7467ba7dd13ddace4bd3366375a9251b97e1e62861b99d2d9e82edb7
SSDEEP

6144:sA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:sATuTAnKGwUAW3ycQqgf

Score

10^/10

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\40800DED = "C:\\Users\\Admin\\AppData\\Roaming\\40800DED\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2692 winver.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exewinver.exe

description	pid	process	target process
PID 2204 wrote to memory of 2692	2204	5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe	winver.exe
PID 2204 wrote to memory of 2692	2204	5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe	winver.exe
PID 2204 wrote to memory of 2692	2204	5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe	winver.exe
PID 2204 wrote to memory of 2692	2204	5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe	winver.exe
PID 2204 wrote to memory of 2692	2204	5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe	winver.exe
PID 2692 wrote to memory of 1224	2692	winver.exe	Explorer.EXE
PID 2692 wrote to memory of 1108	2692	winver.exe	taskhost.exe
PID 2692 wrote to memory of 1180	2692	winver.exe	Dwm.exe
PID 2692 wrote to memory of 1224	2692	winver.exe	Explorer.EXE
PID 2692 wrote to memory of 2204	2692	winver.exe	5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe

C:\Users\Admin\AppData\Local\Temp\5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe
"C:\Users\Admin\AppData\Local\Temp\5711a015d2773eac466fe6d7c972920cd6c0a3998de07f67dbefe81b24b59fdc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2204

memory/1108-9-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1108-23-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1180-25-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1180-12-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1224-3-0x0000000002530000-0x0000000002536000-memory.dmp

Filesize
24KB

Download
memory/1224-15-0x0000000002540000-0x0000000002546000-memory.dmp

Filesize
24KB

Download
memory/1224-6-0x0000000002530000-0x0000000002536000-memory.dmp

Filesize
24KB

Download
memory/1224-1-0x0000000002530000-0x0000000002536000-memory.dmp

Filesize
24KB

Download
memory/1224-24-0x0000000002540000-0x0000000002546000-memory.dmp

Filesize
24KB

Download
memory/2204-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2692-20-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2692-4-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2692-27-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download