numando | 2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0

General

Target

2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll
Size

8.5MB
MD5

47cc8bdbe3ef5a2dc2105328c955fca0
SHA1

518788278e6ecc4bfb640f25ae4bf191c35d1f23
SHA256

2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0
SHA512

0bf0895a23b28ce86269ea01ce74515aacb66a90b88df87d560e679dc816f347421903301cd8d4e3bbd8e38f032efbdd18280b1b77c73f846a05f01d30b593f5

Score

10^/10

Malware Config

Signatures

Detect Numando Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1892-86-0x0000000001F30000-0x000000000308F000-memory.dmp	family_numando
behavioral1/memory/1892-89-0x0000000001F30000-0x000000000308F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1892-86-0x0000000001F30000-0x000000000308F000-memory.dmp	vmprotect
behavioral1/memory/1892-89-0x0000000001F30000-0x000000000308F000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	1892	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	rundll32.exe
1892	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 480 wrote to memory of 1892	480	rundll32.exe	28
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29
PID 1892 wrote to memory of 1592	1892	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 308
    3⤵
    - Program crash
    PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-68-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1892-58-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1892-73-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1892-75-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1892-61-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1892-63-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1892-65-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1892-89-0x0000000001F30000-0x000000000308F000-memory.dmp

Filesize
17.4MB

Download
memory/1892-56-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1892-60-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1892-78-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1892-80-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1892-83-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1892-85-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1892-86-0x0000000001F30000-0x000000000308F000-memory.dmp

Filesize
17.4MB

Download
memory/1892-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1892-70-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing