MALICIOUS — 649337c60dc50a86ecc7838d73df1a2da990c256d771f95379c09d11064959dc

MALICIOUS — 649337c60dc50a86ecc7838d73df1a2da990c256d771f95379c09d11064959dc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the TinyBanker family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 649337c60dc50a86ecc7838d73df1a2da990c256d771f95379c09d11064959dc
SHA-1: f5936c233cb0904323b9e5b87bb4b272f5ae6fb2
MD5: b576920184dea857ffb32b65ef1da1a2
imphash: d0f156be95b89ada5813326f915d62a1
ssdeep: 1536:B5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:B5fvp12UFKcD/6jwqWsN
TLSH: T1C6394CB5863E061BC6FB2265C00D24AE742BB8FBE8D9955E9A03C01777F90D756702B0
Submitted as: 649337c60dc50a86ecc7838d73df1a2da990c256d771f95379c09d11064959dc
File type: pe · Size: 90112 bytes
Verdict: malicious (100/100) · Family: TinyBanker

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.u
ClamAV (daily): Win.Dropper.TinyBanker-9852021-1
Microsoft Defender: Trojan:Win32/Dofoil!pz
Trellix Stinger (McAfee): Packed-FE!B576920184DE
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Dropper.TinyBanker-9852021-1 (rule Win.Dropper.TinyBanker-9852021-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Dofoil!pz (rule Trojan:Win32/Dofoil!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-FE!B576920184DE (rule Packed-FE!B576920184DE) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 10 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.u (rule high-entropy-sections:.u) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.u - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

71340 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe - ee03e0f02572fa63b3dd691eda897f0872515ffcbf3669f8216e2c3fe48be9bc
e05ff00e4b9f615e16ad1844adac4d77ad6b8e9f5c440b18b88ed9388da9810a - e05ff00e4b9f615e16ad1844adac4d77ad6b8e9f5c440b18b88ed9388da9810a
a313b8dbeef74129af6b383ce2d98560b646eaf20980131ef267c7949d549e7b - a313b8dbeef74129af6b383ce2d98560b646eaf20980131ef267c7949d549e7b
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515
2e19d72b64b42673700d68a952f5cc22a6de6a58870e6fcd97cfa6908ad4fb6c - 2e19d72b64b42673700d68a952f5cc22a6de6a58870e6fcd97cfa6908ad4fb6c
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689
7dc77acb07cb8468c0d28e4aaef6c0e3711e8b2e35ff3bd63bb9fb4391fa1c1c - 7dc77acb07cb8468c0d28e4aaef6c0e3711e8b2e35ff3bd63bb9fb4391fa1c1c
02c1902e8c2bef40854c1cf83e89a93c7a37656c052c6d4fa90ac54d4e657add - 02c1902e8c2bef40854c1cf83e89a93c7a37656c052c6d4fa90ac54d4e657add
ab2a1fe4d98552a10551f494bb32e97ad31de3386e4d263f35a09345d71763c9 - ab2a1fe4d98552a10551f494bb32e97ad31de3386e4d263f35a09345d71763c9
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800
a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58 - a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://spaines.pw/EiDQjNbWEQ/

Embedded domains

spaines.pw

Embedded IP addresses

4.207.44.69
52.123.252.227
4.230.171.124
40.84.85.40
20.247.185.124
135.232.92.97
74.179.77.204
104.208.16.94
135.233.45.222
135.233.45.221
20.42.65.91
4.207.44.75
135.234.160.246
52.148.114.188
52.110.12.51
172.178.240.163
52.110.12.52
92.223.78.30
72.145.35.96
216.218.185.162
52.110.12.30
52.110.12.2

More TinyBanker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report