numando | 20ca16d9f4036e64b1f218a47c9d557848720e946edeb0785c744838f0051987 | Triage

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 11:05

Sharing

Report Analysis Logs

General

Target

c06ecbdb7ab16093bd260cbe7f1a04e9.dll
Size

6.4MB
MD5

c06ecbdb7ab16093bd260cbe7f1a04e9
SHA1

b048c10f32d607ed1a24ebc7b274c39e84a22c5a
SHA256

20ca16d9f4036e64b1f218a47c9d557848720e946edeb0785c744838f0051987
SHA512

b5652ed0d7efbddc7956ff6c8a38eeab4a3d29a941febaf09ae52e8dfa150e1dd0d8dc1d90006ed278f7d6c347ee8d55b2d25a020061f0ae6592d9673946f9fb
SSDEEP

196608:ZpeWPeZVRfNwm3UiwSaaFcKbgkZMj2IWOubr/2:WZVRqowSXF8kyyR9/2

Score

10^/10

numando backdoor trojan upx

Malware Config

Signatures

Detect Numando payload 2 IoCs

resource	yara_rule
behavioral2/memory/2472-1-0x00000000024A0000-0x0000000002E9C000-memory.dmp	family_numando
behavioral2/memory/2472-2-0x00000000024A0000-0x0000000002E9C000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2472-0-0x00000000024A0000-0x0000000002E9C000-memory.dmp	upx
behavioral2/memory/2472-1-0x00000000024A0000-0x0000000002E9C000-memory.dmp	upx
behavioral2/memory/2472-2-0x00000000024A0000-0x0000000002E9C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	2472	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2472	4684	rundll32.exe	85
PID 4684 wrote to memory of 2472	4684	rundll32.exe	85
PID 4684 wrote to memory of 2472	4684	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c06ecbdb7ab16093bd260cbe7f1a04e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c06ecbdb7ab16093bd260cbe7f1a04e9.dll,#1
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 760
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2472 -ip 2472
1⤵
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x00000000024A0000-0x0000000002E9C000-memory.dmp

Filesize
10.0MB

Download
memory/2472-1-0x00000000024A0000-0x0000000002E9C000-memory.dmp

Filesize
10.0MB

Download
memory/2472-2-0x00000000024A0000-0x0000000002E9C000-memory.dmp

Filesize
10.0MB

Download