Managed XDR

scratch-zoo-2025-04-10...7dc6ff93bf3d5e97848286 (Tinba, Coinminer) — malware analysis report

File info

Filename
scratch-zoo-2025-04-10-77d3e01d507dc6ff93bf3d5e97848286
File type
Zip archive data, at least v1.0 to extract
File size
3.1 MB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
5804154b86396972a60540a4cab4ae8b3d9c8d0c
SHA256
5b66ce678529873a07976cc7afb31a556d2c32aa67bed24c5510071c80a4a17f
MD5
77d3e01d507dc6ff93bf3d5e97848286

Malwares

  • Tinba
  • Coinminer

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027.002 packer_upx: The executable file is compressed using UPX
T1027.002 pe_features: Executable file has PE anomalies (may be false positive)
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1082 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1135 server_share_info: Retrieves information about each shared resource on a server
T1083 checks_recent_files: Attempt to check recently opened files through registry

Other

yara_rules: Static rules
office_embedded: Office document contains embedded executable file(s)
create_rpc_bindings: Creates RPC connection
require_administrator: Requests administrator privileges
has_pdb: This executable file has a PDB path
origin_langid: Unconventional language of the executable file
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
pe_overlay: PE file contains overlay
valid_authenticode: The digital signature has been verified

Related reports