nymaim | 6cfc0bf3cd583ac6731e8d57d859ab67944a79afbd7ffc69f3cc033b605230ae

Analysis

max time kernel
91s
max time network
25s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 230KB
Sample220930-ab2e6adban
SHA256 6cfc0bf3cd583ac6731e8d57d859ab67944a79afbd7ffc69f3cc033b605230ae
MD5 1388a2a41105db29af1fa61faa8eb86d
SHA1 ab13008e73346144283681e4414bbda1832309fe
SHA512 fa833dedf24f79f30c17b421f986026b9b964d76744a55be9f2ae2083f7b1aa66bfa315ba8961d597f49e8ae0b374883aa3d1b93f2a22f61d6a49eb182ef4bcb
SSDEEP 6144:ZQUtiTVqR9tqy2qHrTvdsRvLBvJfiec0HX/z0oD:ZQUt0qRFVHHvuRHfiec0vzPD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
392	Cleaner.exe

Loads dropped DLL 1 IoCs

pid	Process
364	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	392	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1896	file.exe
1896	file.exe
1896	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	Cleaner.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 364	1896	file.exe	29
PID 1896 wrote to memory of 364	1896	file.exe	29
PID 1896 wrote to memory of 364	1896	file.exe	29
PID 1896 wrote to memory of 364	1896	file.exe	29
PID 364 wrote to memory of 392	364	cmd.exe	31
PID 364 wrote to memory of 392	364	cmd.exe	31
PID 364 wrote to memory of 392	364	cmd.exe	31
PID 364 wrote to memory of 392	364	cmd.exe	31
PID 392 wrote to memory of 1376	392	Cleaner.exe	33
PID 392 wrote to memory of 1376	392	Cleaner.exe	33
PID 392 wrote to memory of 1376	392	Cleaner.exe	33

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3DgOeEhN\Cleaner.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Users\Admin\AppData\Local\Temp\3DgOeEhN\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\3DgOeEhN\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 392 -s 1156
      4⤵
      Program crash
      PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\3DgOeEhN\Cleaner.exe
Size 92KB
SHA256 476b74e78b4d23de83e64a73b42eec6e21ae0d76b9545ac6f6bfd6bbbb8d6ce2
MD5 7fcdccaf88186d0028dd2b83644b7754
SHA1 beec064bccb5cb8fa186cfd86860e928f1b4bf61
SHA512 5582528563d413d7c35be170138b708fd78d81e82722d4cbf3b6e7420e6a7682b77fde3625e3f527fdea00990a24661df0df47704d338e2733ff1fd76c332355
SSDEEP 1536:zMP46X/Y5WYxCuKs7boyfQVPxajJ/ieIyO5odcEim8+RauVX:zMTwCA/QBEFiN5oS2nRNVX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path \Users\Admin\AppData\Local\Temp\3DgOeEhN\Cleaner.exe
Size 188KB
SHA256 12827fd440fd8ff9fa6ad7cf4dbef563c156f8dffd02cc19de970f42707e48e4
MD5 ae44aa4c0821a6385f5f06c3ad1874ee
SHA1 7d8db13292d68e429a1c79d5baa48738f1c91a69
SHA512 b31b1c5bc7b5478631c9e7efe9f31b79b190ae6d07850538ddf65226db6971c32679779c65617f498fa21db189f803f54c7896e91001db8afd605abcffe08556
SSDEEP 3072:zMTwCA/QBEFiN5oS2nRNV+CUrMO4SJQoIXYrEMP+nkssIe6qXN:MoZS0RGwg32YrEMP+kzN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-68-0x0000000000520000-0x0000000000562000-memory.dmp

Download

memory/392-65-0x0000000000110000-0x0000000000268000-memory.dmp

Download

memory/392-66-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Download

memory/1896-59-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1896-58-0x000000000028B000-0x00000000002B1000-memory.dmp

Download

memory/1896-56-0x0000000000730000-0x000000000076F000-memory.dmp

Download

memory/1896-57-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1896-54-0x0000000075201000-0x0000000075203000-memory.dmp

Download

memory/1896-55-0x000000000028B000-0x00000000002B1000-memory.dmp

Download

memory/1896-70-0x0000000010000000-0x000000001001B000-memory.dmp

Download