nymaim | d769fac3078aabd89fda8af5cc9793157c65bdd76f7b6430409c1b5925708641

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df03805e4a11b88a7ea81909cd407647.exe
Size 234KB
Sample220920-qy4rssdag8
SHA256 d769fac3078aabd89fda8af5cc9793157c65bdd76f7b6430409c1b5925708641
MD5 df03805e4a11b88a7ea81909cd407647
SHA1 a205a6af55f817c6ff807f572e5b8f33b51aefdc
SHA512 ed018104c8d52a18074e333f29f4f0bd59a5f1b74668202d8d80d40fb730c964613a79c6334b277955ef5a786fa2e039bb698edd3d2eb8952e1ebf3528c1881f
SSDEEP 3072:BuRALgp5dbOux4bwxLMs6Sqaxr6b3IDfuvKVNKn/R/yUBlNH3bZOBciax:bLgZbOux4bkLMs3qGm3QfOIopnHNF9i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
808	Cleaner.exe

Deletes itself 1 IoCs

pid	Process
1504	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
520	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	808	WerFault.exe	30

Kills process with taskkill 1 IoCs

evasion

pid	Process
1956	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1220	df03805e4a11b88a7ea81909cd407647.exe
1220	df03805e4a11b88a7ea81909cd407647.exe
1220	df03805e4a11b88a7ea81909cd407647.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	Cleaner.exe
Token: SeDebugPrivilege	1956	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 520	1220	df03805e4a11b88a7ea81909cd407647.exe	28
PID 1220 wrote to memory of 520	1220	df03805e4a11b88a7ea81909cd407647.exe	28
PID 1220 wrote to memory of 520	1220	df03805e4a11b88a7ea81909cd407647.exe	28
PID 1220 wrote to memory of 520	1220	df03805e4a11b88a7ea81909cd407647.exe	28
PID 520 wrote to memory of 808	520	cmd.exe	30
PID 520 wrote to memory of 808	520	cmd.exe	30
PID 520 wrote to memory of 808	520	cmd.exe	30
PID 520 wrote to memory of 808	520	cmd.exe	30
PID 808 wrote to memory of 2040	808	Cleaner.exe	32
PID 808 wrote to memory of 2040	808	Cleaner.exe	32
PID 808 wrote to memory of 2040	808	Cleaner.exe	32
PID 1220 wrote to memory of 1504	1220	df03805e4a11b88a7ea81909cd407647.exe	33
PID 1220 wrote to memory of 1504	1220	df03805e4a11b88a7ea81909cd407647.exe	33
PID 1220 wrote to memory of 1504	1220	df03805e4a11b88a7ea81909cd407647.exe	33
PID 1220 wrote to memory of 1504	1220	df03805e4a11b88a7ea81909cd407647.exe	33
PID 1504 wrote to memory of 1956	1504	cmd.exe	35
PID 1504 wrote to memory of 1956	1504	cmd.exe	35
PID 1504 wrote to memory of 1956	1504	cmd.exe	35
PID 1504 wrote to memory of 1956	1504	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\df03805e4a11b88a7ea81909cd407647.exe
"C:\Users\Admin\AppData\Local\Temp\df03805e4a11b88a7ea81909cd407647.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Cleaner.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 808 -s 1160
      4⤵
      Program crash
      PID:2040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "df03805e4a11b88a7ea81909cd407647.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\df03805e4a11b88a7ea81909cd407647.exe" & exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "df03805e4a11b88a7ea81909cd407647.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path \Users\Admin\AppData\Local\Temp\Ij82RIun38n0Ls17pePhed1shD\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/808-65-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Download

memory/808-64-0x00000000009F0000-0x0000000000B46000-memory.dmp

Download

memory/808-67-0x0000000000650000-0x0000000000692000-memory.dmp

Download

memory/1220-55-0x000000000071B000-0x0000000000741000-memory.dmp

Download

memory/1220-57-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/1220-56-0x0000000000240000-0x000000000027F000-memory.dmp

Download

memory/1220-58-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/1220-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Download

memory/1220-69-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/1220-74-0x0000000000400000-0x0000000000594000-memory.dmp

Download