numando | 31a643afb563c602c0985b40788ce5a0c0bed87123c916baff0a664e132d9e79

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 06:52

Target

cd6216e237f9005c8fd9dd7226b7d63e.dll
Size

1.4MB
MD5

cd6216e237f9005c8fd9dd7226b7d63e
SHA1

0bd2c522b02772e1e28f98064959792d9308a313
SHA256

31a643afb563c602c0985b40788ce5a0c0bed87123c916baff0a664e132d9e79
SHA512

e146dd477c86668a1625c92ec8756fdddf4896c1ab7a4ecc99fe7e3a6d0c1b77993e2854a07bad94d59fe6308e0ff03690fda926bf525212c7606ff197a5f802
SSDEEP

24576:r5+kiX8lJBLMHZrMm1A2vCHespF/uCLk+/xPv45MYhBCXxU2mb2cN:r5niXcKZrU2vCHeikQPQ5MYhBWxU2m24

Score

10^/10

Detect Numando payload 1 IoCs

resource	yara_rule
behavioral2/memory/1036-1-0x0000000000400000-0x000000000084E000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1036-0-0x0000000000400000-0x000000000084E000-memory.dmp	upx
behavioral2/memory/1036-1-0x0000000000400000-0x000000000084E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3248	1036	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1036	2576	rundll32.exe	84
PID 2576 wrote to memory of 1036	2576	rundll32.exe	84
PID 2576 wrote to memory of 1036	2576	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd6216e237f9005c8fd9dd7226b7d63e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd6216e237f9005c8fd9dd7226b7d63e.dll,#1
  2⤵
  PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 724
    3⤵
    - Program crash
    PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1036 -ip 1036
1⤵
PID:1908

memory/1036-0-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/1036-1-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download