numando | 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5

General

Target

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
Size

10.0MB
MD5

59431e5b73b362bf13f6cbc8f593f465
SHA1

927fb2c5ac6da16214209d28264d850e7228ed7a
SHA256

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
SHA512

cfd086fa39be7be0f725b3998545bdf3d6ff9a012187cc4505ac7f1f79770cfcf01295f93e6e8984f5aece57d4b4cdeaf1545bedcae2ecb9957ca42feb75b72e

Score

10^/10

numando backdoor trojan vmprotect

Malware Config

Signatures

Detect Numando Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp	family_numando
behavioral1/memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1920-56-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect
behavioral1/memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect
behavioral1/memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 1920 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1920 rundll32.exe
1920 rundll32.exe

pid	pid_target	process	target process
1120	1920	WerFault.exe	rundll32.exe

pid	process
1920	rundll32.exe
1920	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1920	1916	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1120	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 1120	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 1120	1920	rundll32.exe	WerFault.exe
PID 1920 wrote to memory of 1120	1920	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 292
3⤵
- Program crash
PID:1120

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-90-0x0000000000000000-mapping.dmp

Download
memory/1920-71-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1920-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1920-69-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1920-59-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-61-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-62-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1920-64-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1920-66-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1920-57-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-56-0x0000000001E70000-0x00000000032F9000-memory.dmp

Filesize
20.5MB

Download
memory/1920-76-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1920-74-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1920-81-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1920-79-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1920-84-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1920-86-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp

Filesize
20.5MB

Download
memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp

Filesize
20.5MB

Download
memory/1920-54-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads