Overview

overview

10

Static

static

f3e180897f...in.msi

windows7_x64

8

f3e180897f...in.msi

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    19-09-2021 11:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi

  • Size

    5.3MB

  • MD5

    c7d18c4670aebfa94bfbe270f651f424

  • SHA1

    4a1c48064167fc4ad5d943a54a34785b3682da92

  • SHA256

    f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85

  • SHA512

    a125054101e7f58e0ed4f48d635959493860c8d26abca8b5c80ba50cddc47a76e787fd65291a0f42f797b958ec133cc6677e76ed49986675b91ef4e90d54c018

Score
10/10
numandobackdoorpersistencespywarestealertrojan

Malware Config

Signatures

  • Detect Numando Payload 1 IoCs
  • Numando

    Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.

    trojanbackdoornumando
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 53 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:664
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:360
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AFD7ABB3D3AF78E058757F46418E38A9
      2⤵
      • Loads dropped DLL
      PID:1364
    • C:\Users\Admin\AppData\Roaming\VOCNT\CZVGBWDIAA\FDYIDYF.exe
      "C:\Users\Admin\AppData\Roaming\VOCNT\CZVGBWDIAA\FDYIDYF.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://bit.ly/3uRWs5E
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:82945 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2100-143-0x00007FFACFCF0000-0x00007FFACFD5B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/2444-145-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2444-141-0x0000000003510000-0x00000000038D1000-memory.dmp

    Filesize

    3.8MB

    Download