nymaim | d769fac3078aabd89fda8af5cc9793157c65bdd76f7b6430409c1b5925708641

Analysis

max time kernel
100s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df03805e4a11b88a7ea81909cd407647.exe
Size 234KB
Sample220920-qy4rssdag8
SHA256 d769fac3078aabd89fda8af5cc9793157c65bdd76f7b6430409c1b5925708641
MD5 df03805e4a11b88a7ea81909cd407647
SHA1 a205a6af55f817c6ff807f572e5b8f33b51aefdc
SHA512 ed018104c8d52a18074e333f29f4f0bd59a5f1b74668202d8d80d40fb730c964613a79c6334b277955ef5a786fa2e039bb698edd3d2eb8952e1ebf3528c1881f
SSDEEP 3072:BuRALgp5dbOux4bwxLMs6Sqaxr6b3IDfuvKVNKn/R/yUBlNH3bZOBciax:bLgZbOux4bkLMs3qGm3QfOIopnHNF9i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3560	Cleaner.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	df03805e4a11b88a7ea81909cd407647.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
5060	976	WerFault.exe	82
440	976	WerFault.exe	82
2388	976	WerFault.exe	82
5008	976	WerFault.exe	82
3444	976	WerFault.exe	82
1512	976	WerFault.exe	82
4648	976	WerFault.exe	82
3708	976	WerFault.exe	82
1012	976	WerFault.exe	82
3980	976	WerFault.exe	82
4604	976	WerFault.exe	82
5004	976	WerFault.exe	82

Kills process with taskkill 1 IoCs

evasion

pid	Process
1424	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
976	df03805e4a11b88a7ea81909cd407647.exe
976	df03805e4a11b88a7ea81909cd407647.exe
976	df03805e4a11b88a7ea81909cd407647.exe
976	df03805e4a11b88a7ea81909cd407647.exe
976	df03805e4a11b88a7ea81909cd407647.exe
976	df03805e4a11b88a7ea81909cd407647.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
976	df03805e4a11b88a7ea81909cd407647.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3560	Cleaner.exe
Token: SeDebugPrivilege	1424	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 2064	976	df03805e4a11b88a7ea81909cd407647.exe	105
PID 976 wrote to memory of 2064	976	df03805e4a11b88a7ea81909cd407647.exe	105
PID 976 wrote to memory of 2064	976	df03805e4a11b88a7ea81909cd407647.exe	105
PID 2064 wrote to memory of 3560	2064	cmd.exe	108
PID 2064 wrote to memory of 3560	2064	cmd.exe	108
PID 976 wrote to memory of 3404	976	df03805e4a11b88a7ea81909cd407647.exe	118
PID 976 wrote to memory of 3404	976	df03805e4a11b88a7ea81909cd407647.exe	118
PID 976 wrote to memory of 3404	976	df03805e4a11b88a7ea81909cd407647.exe	118
PID 3404 wrote to memory of 1424	3404	cmd.exe	122
PID 3404 wrote to memory of 1424	3404	cmd.exe	122
PID 3404 wrote to memory of 1424	3404	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\df03805e4a11b88a7ea81909cd407647.exe
"C:\Users\Admin\AppData\Local\Temp\df03805e4a11b88a7ea81909cd407647.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 452
  2⤵
  - Program crash
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 716
  2⤵
  - Program crash
  PID:440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 784
  2⤵
  - Program crash
  PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 804
  2⤵
  - Program crash
  PID:5008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 856
  2⤵
  - Program crash
  PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 812
  2⤵
  - Program crash
  PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 808
  2⤵
  - Program crash
  PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1168
  2⤵
  - Program crash
  PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1284
  2⤵
  - Program crash
  PID:1012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\VTLF7hTuFN\Cleaner.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\VTLF7hTuFN\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\VTLF7hTuFN\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1284
  2⤵
  - Program crash
  PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1668
  2⤵
  - Program crash
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "df03805e4a11b88a7ea81909cd407647.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\df03805e4a11b88a7ea81909cd407647.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "df03805e4a11b88a7ea81909cd407647.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1644
  2⤵
  - Program crash
  PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 976 -ip 976
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 976 -ip 976
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 976 -ip 976
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 976 -ip 976
1⤵
PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 976 -ip 976
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 976 -ip 976
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 976 -ip 976
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 976 -ip 976
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 976 -ip 976
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 976 -ip 976
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 976 -ip 976
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 976 -ip 976
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\VTLF7hTuFN\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\VTLF7hTuFN\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\VTLF7hTuFN\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/976-132-0x00000000006A8000-0x00000000006CE000-memory.dmp

Download

memory/976-134-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/976-147-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/976-153-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/976-133-0x00000000021B0000-0x00000000021EF000-memory.dmp

Download

memory/976-143-0x00000000006A8000-0x00000000006CE000-memory.dmp

Download

memory/976-144-0x00000000021B0000-0x00000000021EF000-memory.dmp

Download

memory/976-145-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/3560-146-0x00007FFDF4020000-0x00007FFDF4AE1000-memory.dmp

Download

memory/3560-142-0x00007FFDF4020000-0x00007FFDF4AE1000-memory.dmp

Download

memory/3560-141-0x000002B5FE6E0000-0x000002B5FE722000-memory.dmp

Download

memory/3560-139-0x000002B5FB540000-0x000002B5FB696000-memory.dmp

Download