tinba | c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 03:23

Target

c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe
Size

225KB
MD5

8f399ddae78725c3b3a7bca4437ad1b5
SHA1

7868578358c1763474cab810b417016dfc245fd4
SHA256

c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11
SHA512

3ac25140e654a9e7f904396df5e6814cd8bf6ce2acd2ac2f2daa8bab37e990b35ffc7e87376b41ac21f8cda0fcdaa0efdeaa2c3310669d328756760af061287a
SSDEEP

6144:2A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:2ATuTAnKGwUAW3ycQqgf

Score

10^/10

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\5E824750 = "C:\\Users\\Admin\\AppData\\Roaming\\5E824750\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2772 winver.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exewinver.exe

description	pid	process	target process
PID 1252 wrote to memory of 2772	1252	c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe	winver.exe
PID 1252 wrote to memory of 2772	1252	c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe	winver.exe
PID 1252 wrote to memory of 2772	1252	c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe	winver.exe
PID 1252 wrote to memory of 2772	1252	c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe	winver.exe
PID 1252 wrote to memory of 2772	1252	c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe	winver.exe
PID 2772 wrote to memory of 1184	2772	winver.exe	Explorer.EXE
PID 2772 wrote to memory of 1100	2772	winver.exe	taskhost.exe
PID 2772 wrote to memory of 1156	2772	winver.exe	Dwm.exe
PID 2772 wrote to memory of 1184	2772	winver.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe
"C:\Users\Admin\AppData\Local\Temp\c51afb077f9cc2438fb270dff84be123647d20db4e5c21087eea441d63b34c11.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1252

memory/1100-21-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download
memory/1100-11-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download
memory/1156-14-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1156-23-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1184-3-0x0000000002DE0000-0x0000000002DE6000-memory.dmp

Filesize
24KB

Download
memory/1184-17-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

Filesize
24KB

Download
memory/1184-1-0x0000000002DE0000-0x0000000002DE6000-memory.dmp

Filesize
24KB

Download
memory/1184-22-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

Filesize
24KB

Download
memory/1184-6-0x0000000002DE0000-0x0000000002DE6000-memory.dmp

Filesize
24KB

Download
memory/1252-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2772-20-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2772-4-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2772-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download