nymaim | 449b2c20aa95bb6260ceb453a1fdc5ad39112494cbb3602cea9caf170b63248c

Analysis

max time kernel
55s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 231KB
Sample220930-bg8bbsccd6
SHA256 449b2c20aa95bb6260ceb453a1fdc5ad39112494cbb3602cea9caf170b63248c
MD5 6e6dfe6161b9694affceb7ec721b249a
SHA1 d2c38f70fb634dc7a749e0911ca1a399d4afcbc7
SHA512 79bdabaf52122527493849ca37a86d0bdd8f32645ec1cf9ec5a5872f160027248b92537becf644909acb4630d235b621f02abeed65ee38938f004e5d0cfdaa18
SSDEEP 6144:ZA02U/DGznm1kuGGRovHMACmtU5aAUOQFgxO78yz:ZA02U/4meERoEACUs4gE4yz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim trojan

Malware Config

Extracted

Family

nymaim

208.67.104.97
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1184	Cleaner.exe

Loads dropped DLL 1 IoCs

pid	Process
1860	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1184	WerFault.exe	32

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	Cleaner.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1860	948	file.exe	30
PID 948 wrote to memory of 1860	948	file.exe	30
PID 948 wrote to memory of 1860	948	file.exe	30
PID 948 wrote to memory of 1860	948	file.exe	30
PID 1860 wrote to memory of 1184	1860	cmd.exe	32
PID 1860 wrote to memory of 1184	1860	cmd.exe	32
PID 1860 wrote to memory of 1184	1860	cmd.exe	32
PID 1860 wrote to memory of 1184	1860	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Cleaner.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Cleaner.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1184 -s 1144
      4⤵
      Program crash
      PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Bunifu_UI_v1.5.3.dll
Size 56KB
SHA256 5dc42c19fbf64249cf17749becb573a9097dabf4fad5f1b1d41169aadb42f549
MD5 886ae9cbdcf3bd2add56f9bd1726d057
SHA1 58676ca5ef5a6850fbbc3d8797b5d15b721a09ab
SHA512 1f0f8bac563f5ad59c426fd59b86ce5cc3d0091d2825268cfe3c36b25087ce9454838dceb0dacbf16e467fd42d8278bbb71015a523e4524f1538060efd8f404e
SSDEEP 768:WDFVPaZcXFJvT6lEBVkNjzxRvsLruO4Dy8mdJDhscWisVSb92aa:uqZcXFJelEQRE4Dy8Yhsovb92d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Cleaner.exe
Size 38KB
SHA256 f5783164dd1605841b36fd6a29ec1327423f23e06ca87b98afd54b8f1bbd4109
MD5 61bbd4054301f8daeb1db292b0defd3b
SHA1 a17a054cf15c790b1f6e7fdfb79dcc24b7be7360
SHA512 1b111135d89e2b78bc27a063435009a70f6e46689d4bd4653165417994453cf5ff528d9a26002171dbacc600c2c60b8bbc951da8c2cee79b15bd3f4486dcafe5
SSDEEP 768:NoK1MhopC5cbwUY8RjAVuB16XufDaxImEuY5WYxCuKB673Wmm5:zMP46X/Y5WYxCuKs7bw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Cleaner.exe
Size 48KB
SHA256 e954dc391d008cdc4886329f794afa3418965d4068c12d957e3da34a41ae119e
MD5 b83bb416ca41f7b4b0306860ceb35965
SHA1 00322059f9fb56ebe4979a23d263428353690fc0
SHA512 c156f9c7a1304e562d45bc45144536a29ec5b13b0e99d5226dfd57d57ca02f97681c7ffc4495a1dbebc5e4383b802c95602d80d0718c321ad3c428c4f69b5504
SSDEEP 768:NoK1MhopC5cbwUY8RjAVuB16XufDaxImEuY5WYxCuKB673Wmm+Oy5RQ3gv:zMP46X/Y5WYxCuKs7boyfQ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleaner.exe

Path \Users\Admin\AppData\Local\Temp\0owDklUApBwDFjZKNtD6yPmx\Cleaner.exe
Size 83KB
SHA256 8be63da4b19acba06221d7930b914de1cb8932d2dae0e3ea87622d3dc3f3893d
MD5 2addc67c0b8e01166b97aa65ea829c7a
SHA1 cecf45f7c271fd0674d5c9ae8e93a75d09595eea
SHA512 a65e902008d54bdaf84af1d3ed19216adcfa7f1f4bfd2cb68cee15fc8bd102fad435c9a82e706bbe1c07ca01931106f38b3c420b966703a3c3d99c387321adac
SSDEEP 1536:zMP46X/Y5WYxCuKs7boyfQVPxajJ/ieIyO5odcEim8+R3:zMTwCA/QBEFiN5oS2nR3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-58-0x000000000068B000-0x00000000006B2000-memory.dmp

Download

memory/948-59-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/948-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Download

memory/948-57-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/948-55-0x000000000068B000-0x00000000006B2000-memory.dmp

Download

memory/948-56-0x0000000000220000-0x000000000025F000-memory.dmp

Download

memory/1184-65-0x0000000000DD0000-0x0000000000F28000-memory.dmp

Download

memory/1184-66-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download

memory/1184-68-0x0000000000960000-0x00000000009A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads