nymaim | dbd564c49bdb7304272ef7bb82fe535b79e1fad2db68f1381ccf14452582b2cb

Analysis

max time kernel
100s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2022, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 371KB
Sample220915-3c4wwsecd9
SHA256 dbd564c49bdb7304272ef7bb82fe535b79e1fad2db68f1381ccf14452582b2cb
MD5 93c8386c2cea959c13d417e8138d33f1
SHA1 09eb1d5ad3b5a14887c70deb2a9b1c14e23aa897
SHA512 b9e1c092c9a17a57a2909a3ae562e9e0a51fdfba5c66340c3de17c243b5ce4d6f10d9aafe20dfcebb4fea677b3351f465c638aac206dddac49d7eb67ea774779
SSDEEP 6144:S62QkkWY3vhpgvLd8TncS5lQLWlCF+km/C98QSxd6gkslEwFc:S6qkWyvhpgvacS5lQLGG8Qaf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
724	4400	WerFault.exe	80
4136	4400	WerFault.exe	80
2752	4400	WerFault.exe	80
2584	4400	WerFault.exe	80
2104	4400	WerFault.exe	80
324	4400	WerFault.exe	80
3324	4400	WerFault.exe	80
3568	4400	WerFault.exe	80
1824	4400	WerFault.exe	80

Kills process with taskkill 1 IoCs

evasion

pid	Process
828	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4168	4400	file.exe	100
PID 4400 wrote to memory of 4168	4400	file.exe	100
PID 4400 wrote to memory of 4168	4400	file.exe	100
PID 4168 wrote to memory of 828	4168	cmd.exe	104
PID 4168 wrote to memory of 828	4168	cmd.exe	104
PID 4168 wrote to memory of 828	4168	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 440
  2⤵
  - Program crash
  PID:724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 764
  2⤵
  - Program crash
  PID:4136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 804
  2⤵
  - Program crash
  PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 780
  2⤵
  - Program crash
  PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 856
  2⤵
  - Program crash
  PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 928
  2⤵
  - Program crash
  PID:324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1004
  2⤵
  - Program crash
  PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1356
  2⤵
  - Program crash
  PID:3568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "file.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1332
  2⤵
  - Program crash
  PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4400 -ip 4400
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4400 -ip 4400
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4400 -ip 4400
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4400 -ip 4400
1⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4400 -ip 4400
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4400 -ip 4400
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4400 -ip 4400
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4400 -ip 4400
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4400 -ip 4400
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4400-132-0x0000000000699000-0x00000000006C0000-memory.dmp

Download

memory/4400-133-0x0000000002350000-0x0000000002393000-memory.dmp

Download

memory/4400-134-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4400-137-0x0000000000699000-0x00000000006C0000-memory.dmp

Download

memory/4400-138-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads