numando | 2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0

Analysis

Target

2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll
Size

8.5MB
MD5

47cc8bdbe3ef5a2dc2105328c955fca0
SHA1

518788278e6ecc4bfb640f25ae4bf191c35d1f23
SHA256

2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0
SHA512

0bf0895a23b28ce86269ea01ce74515aacb66a90b88df87d560e679dc816f347421903301cd8d4e3bbd8e38f032efbdd18280b1b77c73f846a05f01d30b593f5

Score

10^/10

Detect Numando Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3320-125-0x00000000026F0000-0x000000000384F000-memory.dmp	family_numando
behavioral2/memory/3320-132-0x00000000026F0000-0x000000000384F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3320-125-0x00000000026F0000-0x000000000384F000-memory.dmp	vmprotect
behavioral2/memory/3320-132-0x00000000026F0000-0x000000000384F000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	3320	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3320	3136	rundll32.exe	77
PID 3136 wrote to memory of 3320	3136	rundll32.exe	77
PID 3136 wrote to memory of 3320	3136	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2571cc865fa744e0570865fce009e528aeed805722710725abda3bdf144d0fb0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 700
    3⤵
    - Program crash
    PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3320 -ip 3320
1⤵
PID:2208

memory/3320-125-0x00000000026F0000-0x000000000384F000-memory.dmp

Filesize
17.4MB

Download
memory/3320-126-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/3320-127-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/3320-128-0x0000000003850000-0x0000000003851000-memory.dmp

Filesize
4KB

Download
memory/3320-129-0x0000000003870000-0x0000000003871000-memory.dmp

Filesize
4KB

Download
memory/3320-130-0x0000000003880000-0x0000000003881000-memory.dmp

Filesize
4KB

Download
memory/3320-131-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/3320-132-0x00000000026F0000-0x000000000384F000-memory.dmp

Filesize
17.4MB

Download