numando | 6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 08:10

Target

9ffac7533cb82db816f39c5595201658_JaffaCakes118.dll
Size

1.3MB
MD5

9ffac7533cb82db816f39c5595201658
SHA1

148f35a1fdf7d62401910f25123ee50f4d534bdb
SHA256

6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215
SHA512

c72cba78fff45360335269681f13a2569d084f766e378d25cc6ce713504ecc62a6b3a3f1362b636f2d600db2df900ff853c5a9efdc8d72200842662199ed58a8
SSDEEP

24576:39HtJTKSpLU8IoC8inRRiPJryL7pIPkNY5TVvv7+O+gG:BKSRUkCHbe+L7prsVn7+O+gG

Score

10^/10

Detect Numando payload 2 IoCs

resource	yara_rule
behavioral2/memory/232-1-0x0000000002180000-0x000000000269B000-memory.dmp	family_numando
behavioral2/memory/232-3-0x0000000002180000-0x000000000269B000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/232-0-0x0000000002180000-0x000000000269B000-memory.dmp	upx
behavioral2/memory/232-1-0x0000000002180000-0x000000000269B000-memory.dmp	upx
behavioral2/memory/232-3-0x0000000002180000-0x000000000269B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	232	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 232	1584	rundll32.exe	82
PID 1584 wrote to memory of 232	1584	rundll32.exe	82
PID 1584 wrote to memory of 232	1584	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffac7533cb82db816f39c5595201658_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffac7533cb82db816f39c5595201658_JaffaCakes118.dll,#1
  2⤵
  PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 700
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 232 -ip 232
1⤵
PID:1448

memory/232-0-0x0000000002180000-0x000000000269B000-memory.dmp

Filesize
5.1MB

Download
memory/232-1-0x0000000002180000-0x000000000269B000-memory.dmp

Filesize
5.1MB

Download
memory/232-3-0x0000000002180000-0x000000000269B000-memory.dmp

Filesize
5.1MB

Download