nymaim | 94c1d71a810fd2cdc158e8a676abbfc53c5d420119f9998d442797f387d08bdc

Analysis

max time kernel
116s
max time network
118s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac92ebde229bb0a67f840a8346d3c8d5.exe
Size 233KB
Sample220920-ttmt9sdff9
SHA256 94c1d71a810fd2cdc158e8a676abbfc53c5d420119f9998d442797f387d08bdc
MD5 ac92ebde229bb0a67f840a8346d3c8d5
SHA1 6fdb81ca82ccd581fc19c862c6b31f88a03677ad
SHA512 f10ded50dd1e47da7cc791c40828980439b5a4ff889a91c2570fb641431c3408bb26d07b28f6107b00bf7b612a1820863996b6d6fb85bb55a4c61d063acb8669
SSDEEP 6144:cALlmqDACPtc8Xs96VEItfDChrJyLiJTg+vx0:cAhBXP+96V1DUQLWx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
560	Cleaner.exe

Deletes itself 1 IoCs

pid	Process
1904	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1564	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	560	WerFault.exe	31

Kills process with taskkill 1 IoCs

evasion

pid	Process
360	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
864	ac92ebde229bb0a67f840a8346d3c8d5.exe
864	ac92ebde229bb0a67f840a8346d3c8d5.exe
864	ac92ebde229bb0a67f840a8346d3c8d5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	Cleaner.exe
Token: SeDebugPrivilege	360	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1564	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	29
PID 864 wrote to memory of 1564	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	29
PID 864 wrote to memory of 1564	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	29
PID 864 wrote to memory of 1564	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	29
PID 1564 wrote to memory of 560	1564	cmd.exe	31
PID 1564 wrote to memory of 560	1564	cmd.exe	31
PID 1564 wrote to memory of 560	1564	cmd.exe	31
PID 1564 wrote to memory of 560	1564	cmd.exe	31
PID 560 wrote to memory of 1492	560	Cleaner.exe	33
PID 560 wrote to memory of 1492	560	Cleaner.exe	33
PID 560 wrote to memory of 1492	560	Cleaner.exe	33
PID 864 wrote to memory of 1904	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	34
PID 864 wrote to memory of 1904	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	34
PID 864 wrote to memory of 1904	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	34
PID 864 wrote to memory of 1904	864	ac92ebde229bb0a67f840a8346d3c8d5.exe	34
PID 1904 wrote to memory of 360	1904	cmd.exe	36
PID 1904 wrote to memory of 360	1904	cmd.exe	36
PID 1904 wrote to memory of 360	1904	cmd.exe	36
PID 1904 wrote to memory of 360	1904	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\ac92ebde229bb0a67f840a8346d3c8d5.exe
"C:\Users\Admin\AppData\Local\Temp\ac92ebde229bb0a67f840a8346d3c8d5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Cleaner.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 560 -s 1156
      4⤵
      Program crash
      PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "ac92ebde229bb0a67f840a8346d3c8d5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ac92ebde229bb0a67f840a8346d3c8d5.exe" & exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "ac92ebde229bb0a67f840a8346d3c8d5.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path \Users\Admin\AppData\Local\Temp\1xlJMnUIt7Vm\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-63-0x0000000000880000-0x00000000009D6000-memory.dmp

Download

memory/560-68-0x0000000000820000-0x0000000000862000-memory.dmp

Download

memory/560-66-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download

memory/864-64-0x000000000072B000-0x0000000000751000-memory.dmp

Download

memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmp

Download

memory/864-65-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/864-57-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/864-56-0x0000000000220000-0x000000000025F000-memory.dmp

Download

memory/864-70-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/864-75-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/864-55-0x000000000072B000-0x0000000000751000-memory.dmp

Download