numando | 6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 08:10

Target

9ffac7533cb82db816f39c5595201658_JaffaCakes118.dll
Size

1.3MB
MD5

9ffac7533cb82db816f39c5595201658
SHA1

148f35a1fdf7d62401910f25123ee50f4d534bdb
SHA256

6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215
SHA512

c72cba78fff45360335269681f13a2569d084f766e378d25cc6ce713504ecc62a6b3a3f1362b636f2d600db2df900ff853c5a9efdc8d72200842662199ed58a8
SSDEEP

24576:39HtJTKSpLU8IoC8inRRiPJryL7pIPkNY5TVvv7+O+gG:BKSRUkCHbe+L7prsVn7+O+gG

Score

10^/10

Detect Numando payload 1 IoCs

resource	yara_rule
behavioral1/memory/2548-1-0x0000000001FB0000-0x00000000024CB000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2548-0-0x0000000001FB0000-0x00000000024CB000-memory.dmp	upx
behavioral1/memory/2548-1-0x0000000001FB0000-0x00000000024CB000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2548	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 1704 wrote to memory of 2548	1704	rundll32.exe	28
PID 2548 wrote to memory of 2724	2548	rundll32.exe	29
PID 2548 wrote to memory of 2724	2548	rundll32.exe	29
PID 2548 wrote to memory of 2724	2548	rundll32.exe	29
PID 2548 wrote to memory of 2724	2548	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffac7533cb82db816f39c5595201658_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffac7533cb82db816f39c5595201658_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 308
    3⤵
    - Program crash
    PID:2724

memory/2548-0-0x0000000001FB0000-0x00000000024CB000-memory.dmp

Filesize
5.1MB

Download
memory/2548-1-0x0000000001FB0000-0x00000000024CB000-memory.dmp

Filesize
5.1MB

Download