numando | 20ca16d9f4036e64b1f218a47c9d557848720e946edeb0785c744838f0051987

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 11:05

Target

c06ecbdb7ab16093bd260cbe7f1a04e9.dll
Size

6.4MB
MD5

c06ecbdb7ab16093bd260cbe7f1a04e9
SHA1

b048c10f32d607ed1a24ebc7b274c39e84a22c5a
SHA256

20ca16d9f4036e64b1f218a47c9d557848720e946edeb0785c744838f0051987
SHA512

b5652ed0d7efbddc7956ff6c8a38eeab4a3d29a941febaf09ae52e8dfa150e1dd0d8dc1d90006ed278f7d6c347ee8d55b2d25a020061f0ae6592d9673946f9fb
SSDEEP

196608:ZpeWPeZVRfNwm3UiwSaaFcKbgkZMj2IWOubr/2:WZVRqowSXF8kyyR9/2

Score

10^/10

Detect Numando payload 4 IoCs

resource	yara_rule
behavioral1/memory/2192-1-0x0000000002080000-0x0000000002A7C000-memory.dmp	family_numando
behavioral1/memory/2192-2-0x0000000002080000-0x0000000002A7C000-memory.dmp	family_numando
behavioral1/memory/2192-3-0x0000000002080000-0x0000000002A7C000-memory.dmp	family_numando
behavioral1/memory/2192-4-0x0000000002080000-0x0000000002A7C000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2192-0-0x0000000002080000-0x0000000002A7C000-memory.dmp	upx
behavioral1/memory/2192-1-0x0000000002080000-0x0000000002A7C000-memory.dmp	upx
behavioral1/memory/2192-2-0x0000000002080000-0x0000000002A7C000-memory.dmp	upx
behavioral1/memory/2192-3-0x0000000002080000-0x0000000002A7C000-memory.dmp	upx
behavioral1/memory/2192-4-0x0000000002080000-0x0000000002A7C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2160 wrote to memory of 2192	2160	rundll32.exe	28
PID 2192 wrote to memory of 3036	2192	rundll32.exe	29
PID 2192 wrote to memory of 3036	2192	rundll32.exe	29
PID 2192 wrote to memory of 3036	2192	rundll32.exe	29
PID 2192 wrote to memory of 3036	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c06ecbdb7ab16093bd260cbe7f1a04e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c06ecbdb7ab16093bd260cbe7f1a04e9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 364
    3⤵
    - Program crash
    PID:3036

memory/2192-0-0x0000000002080000-0x0000000002A7C000-memory.dmp

Filesize
10.0MB

Download
memory/2192-1-0x0000000002080000-0x0000000002A7C000-memory.dmp

Filesize
10.0MB

Download
memory/2192-2-0x0000000002080000-0x0000000002A7C000-memory.dmp

Filesize
10.0MB

Download
memory/2192-3-0x0000000002080000-0x0000000002A7C000-memory.dmp

Filesize
10.0MB

Download
memory/2192-4-0x0000000002080000-0x0000000002A7C000-memory.dmp

Filesize
10.0MB

Download