numando | 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5

Analysis

max time kernel
4294181s
max time network
129s
platform
windows7_x64
resource
win7-20220310-en
submitted
26/03/2022, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
Size 10.0MB
Sample220326-ynzzvsdbfr
SHA256 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
MD5 59431e5b73b362bf13f6cbc8f593f465
SHA1 927fb2c5ac6da16214209d28264d850e7228ed7a
SHA512 cfd086fa39be7be0f725b3998545bdf3d6ff9a012187cc4505ac7f1f79770cfcf01295f93e6e8984f5aece57d4b4cdeaf1545bedcae2ecb9957ca42feb75b72e
MD5 SHA1 SHA512

Score

10^/10

numando backdoor trojan vmprotect

Malware Config

Signatures

Detect Numando Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp	family_numando
behavioral1/memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1920-56-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect
behavioral1/memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect
behavioral1/memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	1920	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	rundll32.exe
1920	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 292
    3⤵
    - Program crash
    PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-71-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1920-74-0x00000000001A0000-0x00000000001A1000-memory.dmp

Download

memory/1920-57-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1920-61-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1920-62-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1920-64-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1920-66-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1920-56-0x0000000001E70000-0x00000000032F9000-memory.dmp

Download

memory/1920-69-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1920-59-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1920-76-0x00000000001A0000-0x00000000001A1000-memory.dmp

Download

memory/1920-81-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/1920-79-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/1920-84-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/1920-86-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp

Download

memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp

Download

memory/1920-55-0x0000000075441000-0x0000000075443000-memory.dmp

Download