numando | 308d07fa6ea5a3e88f7bbdcbc5d7df86efb1c39c6736ab16059d88046c99933f

Analysis

Target

Oleacc.dll
Size

9.0MB
MD5

96e5dabb986d4a653ba7382f14e9f4af
SHA1

2af9c00f61fd821f7dbdbd222e2ca2b1652ecca7
SHA256

e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8
SHA512

6c37f8890ffe8a89d143e00a0e1368af1a43bd9d42025e185d879f61fe7307bce60c4055eab4da3a00cd1e13f1cb21b5b0548bae48087c960b49c3b7eb529878

Score

10^/10

Detect Numando Payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1320-56-0x00000000020F0000-0x00000000029FF000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 1320 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1672 WerFault.exe
1672 WerFault.exe
1672 WerFault.exe
1672 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1672 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1672 WerFault.exe

pid	pid_target	process	target process
1672	1320	WerFault.exe	rundll32.exe

pid	process
1672	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1672	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1320	1972	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1672	1320	rundll32.exe	WerFault.exe
PID 1320 wrote to memory of 1672	1320	rundll32.exe	WerFault.exe
PID 1320 wrote to memory of 1672	1320	rundll32.exe	WerFault.exe
PID 1320 wrote to memory of 1672	1320	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 300
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1672

memory/1320-54-0x0000000000000000-mapping.dmp

Download
memory/1320-55-0x0000000074B21000-0x0000000074B23000-memory.dmp

Filesize
8KB

Download
memory/1320-56-0x00000000020F0000-0x00000000029FF000-memory.dmp

Filesize
9.1MB

Download
memory/1672-57-0x0000000000000000-mapping.dmp

Download
memory/1672-58-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download