numando | 2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220331-en
submitted
27/03/2022, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll
Size 8.5MB
Sample220327-z7mdjsdbb4
SHA256 2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0
MD5 47cc8bdbe3ef5a2dc2105328c955fca0
SHA1 518788278e6ecc4bfb640f25ae4bf191c35d1f23
SHA512 0bf0895a23b28ce86269ea01ce74515aacb66a90b88df87d560e679dc816f347421903301cd8d4e3bbd8e38f032efbdd18280b1b77c73f846a05f01d30b593f5
MD5 SHA1 SHA512

Score

10^/10

numando backdoor trojan vmprotect

Malware Config

Signatures

Detect Numando Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1892-86-0x0000000001F30000-0x000000000308F000-memory.dmp	family_numando
behavioral1/memory/1892-89-0x0000000001F30000-0x000000000308F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1892-86-0x0000000001F30000-0x000000000308F000-memory.dmp	vmprotect
behavioral1/memory/1892-89-0x0000000001F30000-0x000000000308F000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	1892	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	rundll32.exe
1892	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 308
    3⤵
    - Program crash
    PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-68-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1892-75-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1892-58-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/1892-60-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/1892-61-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/1892-63-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/1892-65-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/1892-56-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/1892-70-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1892-73-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1892-78-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1892-80-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1892-83-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1892-85-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1892-86-0x0000000001F30000-0x000000000308F000-memory.dmp

Download

memory/1892-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1892-89-0x0000000001F30000-0x000000000308F000-memory.dmp

Download