nymaim | c6a15b35a1fc2a1c4f26f903117e71ce5bc21bf0b2a5ebeadd12e7214c8417b8

Analysis

max time kernel
150s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 364KB
Sample220919-e7874agcf5
SHA256 c6a15b35a1fc2a1c4f26f903117e71ce5bc21bf0b2a5ebeadd12e7214c8417b8
MD5 1a1e5d900fb4f664b16da2882956bca8
SHA1 79cf4d46f1563e9fbd9ee031f566a5d74fd6c5dc
SHA512 936d811220c6a2e81bb7e55a906c3392e4051aeb2b8eec9c0b9c542ac4eb44dd10eeab1ae2c9d98a126d5f3f32631e6b0acd1394e6ec7b0606a5160dc64e6eed
SSDEEP 6144:tx8BUXLDKiLvG7n8hn+PE99KznabfCDZFdwLRzcfNd0HPjigavwVf:tx8BU3KizG7/Er3fCD+L2f4W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4904	4560	WerFault.exe	81
3604	4560	WerFault.exe	81
4552	4560	WerFault.exe	81
1424	4560	WerFault.exe	81
1704	4560	WerFault.exe	81
2784	4560	WerFault.exe	81
1908	4560	WerFault.exe	81
2728	4560	WerFault.exe	81
1404	4560	WerFault.exe	81
2388	4560	WerFault.exe	81
3512	4560	WerFault.exe	81
4680	4560	WerFault.exe	81
816	4560	WerFault.exe	81
3268	4560	WerFault.exe	81
1208	4560	WerFault.exe	81

Kills process with taskkill 1 IoCs

evasion

pid	Process
3056	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4560	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1792	4560	file.exe	118
PID 4560 wrote to memory of 1792	4560	file.exe	118
PID 4560 wrote to memory of 1792	4560	file.exe	118
PID 1792 wrote to memory of 3056	1792	cmd.exe	122
PID 1792 wrote to memory of 3056	1792	cmd.exe	122
PID 1792 wrote to memory of 3056	1792	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 456
  2⤵
  - Program crash
  PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 716
  2⤵
  - Program crash
  PID:3604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 784
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 820
  2⤵
  - Program crash
  PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 828
  2⤵
  - Program crash
  PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 928
  2⤵
  - Program crash
  PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1012
  2⤵
  - Program crash
  PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1040
  2⤵
  - Program crash
  PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 776
  2⤵
  - Program crash
  PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1012
  2⤵
  - Program crash
  PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 992
  2⤵
  - Program crash
  PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1012
  2⤵
  - Program crash
  PID:4680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1320
  2⤵
  - Program crash
  PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1344
  2⤵
  - Program crash
  PID:3268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "file.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 492
  2⤵
  - Program crash
  PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4560 -ip 4560
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4560 -ip 4560
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4560 -ip 4560
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4560 -ip 4560
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4560 -ip 4560
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4560 -ip 4560
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4560 -ip 4560
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4560 -ip 4560
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4560 -ip 4560
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4560 -ip 4560
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4560 -ip 4560
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4560 -ip 4560
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4560 -ip 4560
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4560 -ip 4560
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4560 -ip 4560
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4560-132-0x0000000000579000-0x00000000005A0000-memory.dmp

Download

memory/4560-133-0x00000000021C0000-0x0000000002202000-memory.dmp

Download

memory/4560-134-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4560-135-0x0000000000579000-0x00000000005A0000-memory.dmp

Download

memory/4560-136-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4560-139-0x0000000000579000-0x00000000005A0000-memory.dmp

Download

memory/4560-140-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads