numando | e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8

Analysis

Target

Oleacc.dll
Size

9.0MB
MD5

96e5dabb986d4a653ba7382f14e9f4af
SHA1

2af9c00f61fd821f7dbdbd222e2ca2b1652ecca7
SHA256

e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8
SHA512

6c37f8890ffe8a89d143e00a0e1368af1a43bd9d42025e185d879f61fe7307bce60c4055eab4da3a00cd1e13f1cb21b5b0548bae48087c960b49c3b7eb529878

Score

10^/10

Detect Numando Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1688-56-0x0000000002260000-0x0000000002B6F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

656 1688 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

656 WerFault.exe
656 WerFault.exe
656 WerFault.exe
656 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

656 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 656 WerFault.exe

pid	pid_target	process	target process
656	1688	WerFault.exe	rundll32.exe

pid	process
656	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	656	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1688	844	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 656	1688	rundll32.exe	WerFault.exe
PID 1688 wrote to memory of 656	1688	rundll32.exe	WerFault.exe
PID 1688 wrote to memory of 656	1688	rundll32.exe	WerFault.exe
PID 1688 wrote to memory of 656	1688	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 300
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:656

memory/656-57-0x0000000000000000-mapping.dmp

Download
memory/656-58-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1688-54-0x0000000000000000-mapping.dmp

Download
memory/1688-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1688-56-0x0000000002260000-0x0000000002B6F000-memory.dmp

Filesize
9.1MB

Download