nymaim | 94c1d71a810fd2cdc158e8a676abbfc53c5d420119f9998d442797f387d08bdc

Analysis

max time kernel
102s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac92ebde229bb0a67f840a8346d3c8d5.exe
Size 233KB
Sample220920-ttmt9sdff9
SHA256 94c1d71a810fd2cdc158e8a676abbfc53c5d420119f9998d442797f387d08bdc
MD5 ac92ebde229bb0a67f840a8346d3c8d5
SHA1 6fdb81ca82ccd581fc19c862c6b31f88a03677ad
SHA512 f10ded50dd1e47da7cc791c40828980439b5a4ff889a91c2570fb641431c3408bb26d07b28f6107b00bf7b612a1820863996b6d6fb85bb55a4c61d063acb8669
SSDEEP 6144:cALlmqDACPtc8Xs96VEItfDChrJyLiJTg+vx0:cAhBXP+96V1DUQLWx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3700	Cleaner.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ac92ebde229bb0a67f840a8346d3c8d5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
4200	1456	WerFault.exe	83
4616	1456	WerFault.exe	83
1780	1456	WerFault.exe	83
2992	1456	WerFault.exe	83
3132	1456	WerFault.exe	83
1228	1456	WerFault.exe	83
3108	1456	WerFault.exe	83
1196	1456	WerFault.exe	83
2352	1456	WerFault.exe	83
2288	1456	WerFault.exe	83
3120	1456	WerFault.exe	83
2540	1456	WerFault.exe	83

Kills process with taskkill 1 IoCs

evasion

pid	Process
4020	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1456	ac92ebde229bb0a67f840a8346d3c8d5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	Cleaner.exe
Token: SeDebugPrivilege	4020	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 728	1456	ac92ebde229bb0a67f840a8346d3c8d5.exe	109
PID 1456 wrote to memory of 728	1456	ac92ebde229bb0a67f840a8346d3c8d5.exe	109
PID 1456 wrote to memory of 728	1456	ac92ebde229bb0a67f840a8346d3c8d5.exe	109
PID 728 wrote to memory of 3700	728	cmd.exe	111
PID 728 wrote to memory of 3700	728	cmd.exe	111
PID 1456 wrote to memory of 4388	1456	ac92ebde229bb0a67f840a8346d3c8d5.exe	127
PID 1456 wrote to memory of 4388	1456	ac92ebde229bb0a67f840a8346d3c8d5.exe	127
PID 1456 wrote to memory of 4388	1456	ac92ebde229bb0a67f840a8346d3c8d5.exe	127
PID 4388 wrote to memory of 4020	4388	cmd.exe	131
PID 4388 wrote to memory of 4020	4388	cmd.exe	131
PID 4388 wrote to memory of 4020	4388	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\ac92ebde229bb0a67f840a8346d3c8d5.exe
"C:\Users\Admin\AppData\Local\Temp\ac92ebde229bb0a67f840a8346d3c8d5.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 444
  2⤵
  - Program crash
  PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 764
  2⤵
  - Program crash
  PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 788
  2⤵
  - Program crash
  PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 788
  2⤵
  - Program crash
  PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 860
  2⤵
  - Program crash
  PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 884
  2⤵
  - Program crash
  PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 776
  2⤵
  - Program crash
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1048
  2⤵
  - Program crash
  PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1392
  2⤵
  - Program crash
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\vwJgFa086\Cleaner.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Users\Admin\AppData\Local\Temp\vwJgFa086\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\vwJgFa086\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1392
  2⤵
  - Program crash
  PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1732
  2⤵
  - Program crash
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "ac92ebde229bb0a67f840a8346d3c8d5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ac92ebde229bb0a67f840a8346d3c8d5.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "ac92ebde229bb0a67f840a8346d3c8d5.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 492
  2⤵
  - Program crash
  PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1456 -ip 1456
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1456 -ip 1456
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1456 -ip 1456
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1456 -ip 1456
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1456 -ip 1456
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1456 -ip 1456
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1456 -ip 1456
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1456 -ip 1456
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1456 -ip 1456
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1456 -ip 1456
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1456 -ip 1456
1⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1456 -ip 1456
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\vwJgFa086\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\vwJgFa086\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\vwJgFa086\Cleaner.exe
Size 3.7MB
SHA256 66c544c7794eff9840c5353173671293847dc4fedfeabe19e2933c3a47812413
MD5 fa76b043efa7b9933f550bd299add3df
SHA1 627d7d59111c13acdacf984437d35ebcc30f8e8f
SHA512 5e7f05198a48d7c7567cdf941b422b9a092b5fdc9f6ac065a8f47f77fdcc87650f29f2efca3dd1f755e47f387c2f85fe1ae2e8ad355c3a8e7fadd90475112850
SSDEEP 98304:i3D///UUrPqER7eXER7e4ER7erER7e/ER7etER7ehER7ea:U1HihHBfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-146-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/1456-133-0x00000000006F0000-0x000000000072F000-memory.dmp

Download

memory/1456-134-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/1456-132-0x00000000007D9000-0x00000000007FF000-memory.dmp

Download

memory/1456-153-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/1456-140-0x00000000007D9000-0x00000000007FF000-memory.dmp

Download

memory/1456-143-0x0000000000400000-0x0000000000594000-memory.dmp

Download

memory/1456-152-0x00000000007D9000-0x00000000007FF000-memory.dmp

Download

memory/3700-145-0x00007FFE93560000-0x00007FFE94021000-memory.dmp

Download

memory/3700-144-0x00007FFE93560000-0x00007FFE94021000-memory.dmp

Download

memory/3700-142-0x00000147894D0000-0x0000014789512000-memory.dmp

Download

memory/3700-139-0x0000014787800000-0x0000014787956000-memory.dmp

Download