numando | e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8

Analysis

Target

Oleacc.dll
Size

9.0MB
MD5

96e5dabb986d4a653ba7382f14e9f4af
SHA1

2af9c00f61fd821f7dbdbd222e2ca2b1652ecca7
SHA256

e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8
SHA512

6c37f8890ffe8a89d143e00a0e1368af1a43bd9d42025e185d879f61fe7307bce60c4055eab4da3a00cd1e13f1cb21b5b0548bae48087c960b49c3b7eb529878

Score

10^/10

Detect Numando Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1688-56-0x0000000002260000-0x0000000002B6F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

Program crash 1 IoCs

pid	pid_target	Process	procid_target
656	1688	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	656	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 844 wrote to memory of 1688	844	rundll32.exe	27
PID 1688 wrote to memory of 656	1688	rundll32.exe	28
PID 1688 wrote to memory of 656	1688	rundll32.exe	28
PID 1688 wrote to memory of 656	1688	rundll32.exe	28
PID 1688 wrote to memory of 656	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 300
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:656

memory/656-58-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1688-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1688-56-0x0000000002260000-0x0000000002B6F000-memory.dmp

Filesize
9.1MB

Download