numando | e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8

Analysis

Target

Oleacc.dll
Size

9.0MB
MD5

96e5dabb986d4a653ba7382f14e9f4af
SHA1

2af9c00f61fd821f7dbdbd222e2ca2b1652ecca7
SHA256

e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8
SHA512

6c37f8890ffe8a89d143e00a0e1368af1a43bd9d42025e185d879f61fe7307bce60c4055eab4da3a00cd1e13f1cb21b5b0548bae48087c960b49c3b7eb529878

Score

10^/10

Detect Numando Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/520-116-0x0000000004B00000-0x000000000540F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 520 WerFault.exe rundll32.exe

pid	pid_target	process	target process
940	520	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 940 WerFault.exe
Token: SeBackupPrivilege 940 WerFault.exe
Token: SeDebugPrivilege 940 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3800 wrote to memory of 520	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 520	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 520	3800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oleacc.dll,#1
  2⤵
  PID:520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 716
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:940

memory/520-115-0x0000000000000000-mapping.dmp

Download
memory/520-116-0x0000000004B00000-0x000000000540F000-memory.dmp

Filesize
9.1MB

Download