tinba | 22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 00:43

Target

22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe
Size

237KB
MD5

5e961c762853b1a0be1799b185f44be0
SHA1

9b3354c41bd7c171c4a6336ccb35df64d081f65c
SHA256

22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f
SHA512

0501a40dff86c2814c7b846bffb4af26fea45118051fdf85fa39e9e322aa1ba1971f68a98449b14e9fd62df3be4e35db89b157556bcc8188e3d6788c39c54ce3
SSDEEP

6144:kA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:kATuTAnKGwUAWVycQqgj

Score

10^/10

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\DA0F29AB = "C:\\Users\\Admin\\AppData\\Roaming\\DA0F29AB\\bin.exe"	winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2732 winver.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exewinver.exe

description	pid	process	target process
PID 2068 wrote to memory of 2732	2068	22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe	winver.exe
PID 2068 wrote to memory of 2732	2068	22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe	winver.exe
PID 2068 wrote to memory of 2732	2068	22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe	winver.exe
PID 2068 wrote to memory of 2732	2068	22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe	winver.exe
PID 2068 wrote to memory of 2732	2068	22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe	winver.exe
PID 2732 wrote to memory of 1188	2732	winver.exe	Explorer.EXE
PID 2732 wrote to memory of 1100	2732	winver.exe	taskhost.exe
PID 2732 wrote to memory of 1160	2732	winver.exe	Dwm.exe
PID 2732 wrote to memory of 1188	2732	winver.exe	Explorer.EXE
PID 2732 wrote to memory of 2068	2732	winver.exe	22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe

C:\Users\Admin\AppData\Local\Temp\22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe
"C:\Users\Admin\AppData\Local\Temp\22623752ba642645eace1b7cc4e4d1f7801ca5bb886c8c4cc61766ea7584a40f.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2068

memory/1100-23-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1100-9-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1160-12-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1160-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1188-6-0x0000000002E00000-0x0000000002E06000-memory.dmp

Filesize
24KB

Download
memory/1188-15-0x0000000002E40000-0x0000000002E46000-memory.dmp

Filesize
24KB

Download
memory/1188-1-0x0000000002E00000-0x0000000002E06000-memory.dmp

Filesize
24KB

Download
memory/1188-3-0x0000000002E00000-0x0000000002E06000-memory.dmp

Filesize
24KB

Download
memory/1188-24-0x0000000002E40000-0x0000000002E46000-memory.dmp

Filesize
24KB

Download
memory/2068-22-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2732-20-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2732-4-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/2732-27-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download