numando | 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5

General

Target

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
Size

10.0MB
MD5

59431e5b73b362bf13f6cbc8f593f465
SHA1

927fb2c5ac6da16214209d28264d850e7228ed7a
SHA256

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
SHA512

cfd086fa39be7be0f725b3998545bdf3d6ff9a012187cc4505ac7f1f79770cfcf01295f93e6e8984f5aece57d4b4cdeaf1545bedcae2ecb9957ca42feb75b72e

Score

10^/10

Malware Config

Signatures

Detect Numando Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp	family_numando
behavioral1/memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1920-56-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect
behavioral1/memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect
behavioral1/memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	1920	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	rundll32.exe
1920	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1916 wrote to memory of 1920	1916	rundll32.exe	27
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28
PID 1920 wrote to memory of 1120	1920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 292
    3⤵
    - Program crash
    PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-71-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1920-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1920-69-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1920-59-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-61-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-62-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1920-64-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1920-66-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1920-57-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-56-0x0000000001E70000-0x00000000032F9000-memory.dmp

Filesize
20.5MB

Download
memory/1920-76-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1920-74-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1920-81-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1920-79-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1920-84-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1920-86-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1920-87-0x0000000001E70000-0x00000000032F9000-memory.dmp

Filesize
20.5MB

Download
memory/1920-89-0x0000000001E70000-0x00000000032F9000-memory.dmp

Filesize
20.5MB

Download

Analysis

Sharing